Cobian RAT S0338

Type: malware
Platform: Windows
Created: 29 January 2019
Last modified: 25 April 2025

Cobian RAT is a backdoor, remote access tool that has been observed since 2016.[1]

Techniques38th pct

Tactics53rd pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Cobian RAT MITRE reference S0338

Keylogging T1056.001 ↗

Cobian RAT has a feature to perform keylogging on the victim’s machine.2

Credential Access · Collection3 detection rules

Windows Command Shell T1059.003 ↗

Cobian RAT can launch a remote command shell interface for executing commands.3

Execution63 detection rules

DNS T1071.004 ↗

Cobian RAT uses DNS for C2.4

Command and Control33 detection rules

Screen Capture T1113 ↗

Cobian RAT has a feature to perform screen capture.5

Collection15 detection rules

Audio Capture T1123 ↗

Cobian RAT has a feature to perform voice recording on the victim’s machine.6

Collection9 detection rules

Video Capture T1125 ↗

Cobian RAT has a feature to access the webcam on the victim’s machine.7

Collection3 detection rules

Standing S0338

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques838th pct

38th percentile · 62% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics653rd pct

53rd percentile · 53% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique12medBottom 22%

22nd percentile · 78% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique5med

Cobian RAT detections S0338

173 distinct rules cover the 8 techniques recorded for this malware. 130 Sigma · 43 Splunk.

8 covered by at least one rule173 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects suspicious DNS queries known from Cobalt Strike beacons	Generic	test	dns	-	-	Command and Control Application Layer Protocol DNS	-	critical	Florian Roth (Nextron Systems)	2018-05-10	2022-10-09	2975af79-28c4-4d2f-a951-9095f229df29
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Well-known DNS Exfiltration tools execution	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Encoding Standard Encoding Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Symmetric Encrypted Non-C2 Protocol	-	high	Daniil Yugoslavskiy, oscd.community	2019-10-24	2021-11-27	98a96a5a-64a0-4c42-92c5-489da3866cb0
Splunk	Detects DNS-based Kerberos coercion attacks where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication such as in CVE-2025-33073. (...)	Generic	stable	dns	windows	Suricata · Sysmon	Credential Access, Collection Adversary-in-the-Middle Name Resolution Poisoning and SMB Relay Command and Control Application Layer Protocol DNS Credential Access Forced Authentication	CVE-2025-33073	medium	Raven Tait, Splunk	2025-11-18	2026-09-08	8551252d-b5b6-4b6e-8a82-51460aeb29a3
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS	-	medium	Ahmed Nosir (@egycondor)	2025-06-02	—	f8c1e80b-c73a-476a-ae24-6c72528b1521
	Detects DNS queries to domains associated with Katz Stealer malware. (...)	Emerging	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-22	—	9c3d6e32-f4c8-4d73-8b8f-95c3b383a13c
	Detects DNS queries to domains associated with Katz Stealer malware. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol DNS	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-22	—	6b0c762f-0e1b-435f-a829-5943b08fe36a
	Detects strings used in command execution in DNS TXT Answer	Generic	test	dns	-	-	Command and Control Application Layer Protocol DNS	-	high	Markus Neis	2018-08-08	2021-11-27	8ae51330-899c-4641-8125-e39f2e07da72
	The PowerShell implementation of DNSCat2 calls nslookup to craft queries. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Obfuscation Protocol or Service Impersonation Exfiltration Exfiltration Over C2 Channel	-	high	Cian Heasley	2020-08-08	2023-02-24	b11d75d6-d7c1-11ea-87d0-0242ac130003
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
Splunk	The following analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. (...)	Anomaly	experimental	dns	-	-	Command and Control Application Layer Protocol DNS	-	medium	bowesmana, Bhavin Patel, Splunk	2019-10-16	2026-05-13	104658f4-afdc-499e-9719-17243f9826f1	-
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects attempts of decoding encoded Gzip archives via PowerShell.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Data Encoding Standard Encoding	-	medium	Hieu Tran	2023-03-13	—	98767d61-b2e8-4d71-b661-e36783ee24c1
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the use of Jlaive to execute assemblies in a copied PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)	2022-05-24	2023-02-22	0a99eb3e-1617-41bd-b095-13dc767f3def
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-23	—	00ca75ab-d5ce-43be-b86c-55ff39c6abfc
	High DNS requests amount from host per short period of time	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	b4163085-4001-46a3-a79a-55d8bbbc7a3a	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	51186749-7415-46be-90e5-6914865c825a	-
	Extremely high rate of NULL record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	44ae5117-9c44-40cf-9c7c-7edad385ca70	-
	Extremely high rate of TXT record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	f0a8cedc-1d22-4453-9c44-8d9f4ebd5d35	-
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
Splunk	The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. (...)	Anomaly	stable	network_connection	-	Zeek	Command and Control Application Layer Protocol Web Protocols Command and Control Data Encoding Standard Encoding	-	medium	Raven Tait, Splunk	2026-10-12	2026-10-12	0590881d-7b81-48dd-9674-1f23f7db5d40
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688