malware

Dok S0281

Type: malware
Platform: macOS
Created: 17 October 2018
Last modified: 17 November 2024

Dok is a Trojan application disguised as a .zip file that is able to collect user credentials and install a malicious proxy server to redirect a user's network traffic (i.e. Adversary-in-the-Middle).[1][2][3]

Techniques51st pct

TacticsTop 11%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0281

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects denied requests by Active Directory Certificate Services. (...)	Generic	test	-	windows	WinEventLog System	Defense Impairment Subvert Trust Controls Install Root Certificate	-	low	@SerkinValery	2024-03-07	—	994bfd6d-0a2e-481e-a861-934069fcf5f5
	Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. (...)	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript	-	high	Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)	2025-11-22	—	e710a880-1f18-4417-b6a0-b5afdf7e33da
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating po (...)	Hunting	experimental	authentication	-	Azure Sign-in Logs · Azure	Credential Access, Collection Adversary-in-the-Middle	-	low	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-04-28	—	ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
	Detects chmod targeting files in sensitive directory paths on Linux systems. (...)	Generic	test	process_creation	linux	Sysmon	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	medium	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2022-06-03	2026-03-18	6419afd1-3742-47a5-a7e6-b50386cd15f8
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access, Discovery Network Sniffing	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
	Show when private keys are being exported from the device, or when new certificates are installed	Generic	test	authentication	-	Cisco AAA · Cisco	Defense Impairment Subvert Trust Controls Install Root Certificate Credential Access Unsecured Credentials Private Keys	-	high	Austin Clark	2019-08-12	2023-01-04	1f978c6a-4415-47fb-aca5-736a44d7ca3d
	Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels	Generic	test	-	-	LDAP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	—	50e606bf-04ce-4ca7-9d54-3449494bbd4b
Splunk	This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter AppleScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-22	6bc88a9d-f7de-4257-b526-acf15bc5a517
Splunk	This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry. (...)	Anomaly	stable	network_device	-	Cisco	Command and Control Proxy Multi-hop Proxy	-	medium	Mahamudul Chowdhury, Bhavin Patel, Splunk	2026-05-06	2026-06-09	a7c8613a-92e2-4232-b64d-bd39d33dee8b
Splunk	The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	3d8536b6-52b4-4c3e-b695-3f2e90bb22be
	Detects access to clipboard content via osascript, which may be used for data collection but also oc (...)	Generic	test	process_creation	macos	-	Collection Clipboard Data Execution Command and Scripting Interpreter AppleScript	-	medium	Sohan G (D4rkCiph3r)	2023-01-31	2026-05-22	7794fa3c-edea-4cff-bec7-267dd4770fd7
	Detects loading of "credui.dll" and related DLLs by an uncommon process. (...)	Generic	test	image_load	windows	Sysmon	Credential Access, Collection Input Capture GUI Input Capture	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-10-20	2026-06-29	9ae01559-cf7e-4f8e-8e14-4c290a1b4784
	Detects attempts to post the file with the usage of wget utility. (...)	Generic	test	process_creation	linux	Linux Auditd	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Pawel Mazur	2021-11-18	2022-12-25	cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
Splunk	The following analytic identifies the presence of unauthorized DHCP servers on the network. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	6e1ada88-7a0d-4ac1-92c6-03d354686079	-
Splunk	The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. (...)	Anomaly	stable	dns	windows	Sysmon	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Bhavin Patel, Splunk	2019-10-16	2026-05-13	1a67f15a-f4ff-4170-84e9-08cf6f75d6f5	-
	Detects DNS queries to an ".onion" address related to Tor routing networks	Generic	test	dns	windows	Sysmon	Command and Control Proxy Multi-hop Proxy	-	high	frack113	2022-02-20	2025-09-12	b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544
	Detects file and folder permission changes.	Generic	test	process_creation	linux	Linux Auditd	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	low	Jakob Weinzettl, oscd.community	2019-09-23	2021-11-27	74c01ace-0152-4094-8ae2-6fd776dd43e5
Splunk	The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. (...)	Hunting	stable	account_management	-	Google Cloud	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Stanislav Miskovic, Splunk	2021-08-17	2026-05-13	dc4dc3a8-ff54-11eb-8bf7-acde48001122
	Detects attempts to use system dialog prompts to capture user credentials	Generic	test	process_creation	macos	-	Credential Access, Collection Input Capture GUI Input Capture	-	low	remotephone, oscd.community	2020-10-13	2025-12-05	60f1ce20-484e-41bd-85f4-ac4afec2c541
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	dns	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	0f6c1bf5-70a5-4963-aef9-aab1eefb50bd	-
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	3b6e327d-8649-4102-993f-d25786481589	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	b4163085-4001-46a3-a79a-55d8bbbc7a3a	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	51186749-7415-46be-90e5-6914865c825a	-
	Extremely high rate of NULL record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	44ae5117-9c44-40cf-9c7c-7edad385ca70	-
	Extremely high rate of TXT record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	f0a8cedc-1d22-4453-9c44-8d9f4ebd5d35	-
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing.	Generic	test	-	-	BGP · Huawei	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	a557ffe6-ac54-43d2-ae69-158027082350
	Detects installation of new certificate on the system which attackers may use to avoid warnings when (...)	Generic	test	process_creation	linux	Sysmon	Defense Impairment Subvert Trust Controls Install Root Certificate	-	low	Ömer Günal, oscd.community	2020-10-05	2026-10-04	78a80655-a51e-4669-bc6b-e9d206a462ee
	Detects the configuration of a new ISATAP router on a Windows host. (...)	Generic	experimental	-	windows	WinEventLog System	Credential Access, Collection Adversary-in-the-Middle Impact Data Manipulation Transmitted Data Manipulation	-	medium	hamid	2025-10-19	—	d22df9cd-2aee-4089-93c7-9dc4eae77f2c
	Detects juniper BGP missing MD5 digest. (...)	Generic	test	-	-	BGP · Juniper	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
	Detects possible malicious execution of JXA in-memory via OSAScript	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript JavaScript	-	high	Sohan G (D4rkCiph3r)	2023-01-31	—	f1408a58-0e94-4165-b80a-da9f96cf6fc3
	Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.	Generic	test	process_creation	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Agent Launch Daemon Execution System Services Launchctl	-	medium	Pratinav Chandra	2024-05-13	—	ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
Splunk	The following analytic detects the use of the Advanced Package Tool (APT) or apt-get with elevated privileges via sudo on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Cisco	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Bhavin Patel, Splunk	2022-08-10	2026-05-13	4d5a05fa-77d9-4fd0-af9c-05704f9f9a88
Splunk	The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	medium	Teoderick Contreras, Splunk	2022-01-05	2026-05-13	7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
Splunk	The following analytic detects the creation of the doas.conf file on a Linux host. (...)	Generic	stable	file_event	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2024-08-09	2026-05-13	61059783-574b-40d2-ac2f-69b898afd6b4
Splunk	The following analytic detects the execution of the 'doas' tool on a Linux host. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	91b8ca78-f205-4826-a3ef-cd8d6b24e97b
Splunk	The following analytic detects suspicious file permission modifications using the `chmod` command, which may indicate an attacker attempting to alter access controls on critical files or directories. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	medium	Teoderick Contreras, Splunk, Ivar Nygård	2024-08-12	2026-05-13	5f1d2ea7-eec0-4790-8b24-6875312ad492
Splunk	The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	f2d1110d-b01c-4a58-9975-90a9edeb083a
Splunk	The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	651df959-ad17-4b73-a323-90cb96d5fa1b
Splunk	The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system. (...)	Anomaly	stable	file_event	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2024-08-09	2026-05-13	8be88f46-f7e8-4ae6-b15e-cf1b13392834
Splunk	The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	817a5c89-5b92-4818-a22d-aa35e1361afe
Splunk	The following analytic detects the use of the AWK command with elevated privileges to execute system commands. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-02-15	2026-05-13	4510cae0-96a2-4840-9919-91d262db210a
Splunk	The following analytic detects the execution of BusyBox with sudo privileges, which can lead to privilege escalation on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	387c4e78-f4a4-413d-ad44-e9f7bc4642c9
Splunk	The following analytic detects the execution of the 'c89' command with elevated privileges, which can be used to compile and execute C programs as root. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	54c95f4d-3e5d-44be-9521-ea19ba62f7a8
Splunk	The following analytic detects the execution of the c99 utility with sudo privileges, which can lead to privilege escalation on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	e1c6dec5-2249-442d-a1f9-99a4bd228183
Splunk	The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Defense Impairment File and Directory Permissions Modification Linux and Mac Permissions	-	medium	Teoderick Contreras, Splunk	2022-01-05	2026-05-13	c1400ea2-6257-11ec-ad49-acde48001122
Splunk	The following analytic detects the execution of the Composer tool with elevated privileges on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	a3bddf71-6ba3-42ab-a6b2-396929b16d92
Splunk	The following analytic detects the use of the 'cpulimit' command with specific flags ('-l', '-f') executed with 'sudo' privileges. (...)	Anomaly	stable	process_creation	linux	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Sudo and Sudo Caching	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-10	2026-05-13	d4e40b7e-aad3-4a7d-aac8-550ea5222be5

Title

Description

Dok S0281

Dok MITRE reference S0281

Standing S0281

Reach

Coverage

Dok detections S0281