malware
NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.[1][2][3][4]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
57th percentile · 57% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
83rd percentile · 83% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 13 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
876 distinct rules cover the 13 techniques recorded for this malware. 574 Sigma · 302 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-10-09 | 1fac1481-2dbc-48b2-9096-753c49b4ec71 | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-12-02 | 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Detects attempts to record audio using the arecord and ecasound utilities. | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur, Milad Cheraghi | 2021-09-04 | 2025-12-05 | a7af2487-9c2f-42e4-9bb9-ff961f0561d5 | ||||
Detects audio capture via PowerShell Cmdlet. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2019-10-24 | 2023-04-06 | 932fb0d8-692b-4b0f-a26e-5643a50fe7d6 | ||||
Detect attacker collecting audio via SoundRecorder application. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community | 2019-10-24 | 2021-11-27 | 83865853-59aa-449e-9600-74b9d89a6d6e | ||||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects changes to the bitbucket audit log configuration. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 6aa12161-235a-4dfb-9c74-fe08df8d8da1 | ||||
Detects Bitbucket global secret scanning rule deletion activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 | ||||
Detects Bitbucket global SSH access configuration changes. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 16ab6143-510a-44e2-a615-bdb80b8317fc | ||||
Detects when a secret scanning allowlist rule is added for projects. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 | ||||
Detects when a repository is exempted from secret scanning feature. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | high | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | b91e8d5e-0033-44fe-973f-b730316f23a1 | ||||
Detects when secret scanning rule is deleted for the project or repository. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | ff91e3f0-ad15-459f-9a85-1556390c138d | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects specific windows registry modifications made by BlackByte ransomware variants. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-24 | 2025-10-21 | 83314318-052a-4c90-a1ad-660ece38d276 | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
All TCP traffic on particular port from attacker is routed to different port. (...) | Generic | test | process_creation | linux | Linux Auditd | - | medium | Rafal Piasecki | 2022-08-10 | — | 70b4156e-50fc-4523-aa50-c9dddf1993fc | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2024-03-05 | 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5 | ||||
Detect possible persistence using Fax DLL load when service restart | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | 9e3357ba-09d4-4fbd-a7c5-ad6386314513 | ||||
Detect change of the user account associated with the FAX service to avoid the escalation problem. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | e3fdf743-f05b-4051-990a-b66919be1743 |