malware

Exaramel for Windows S0343

Type: malware
Platform: Windows
Created: 30 January 2019
Last modified: 16 April 2025

Exaramel for Windows is a backdoor used for targeting Windows systems. The Linux version is tracked separately under Exaramel for Linux.[1]

Techniques38th pct

Tactics53rd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0343

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
Splunk	This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the ' (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Stealth System Binary Proxy Execution Mshta	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
	Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	@SerkinValery, Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2023-08-17	ac9159cc-c364-4304-8f0a-d63fc1a0aabb
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. (...)	Hunting	test	ps_script	windows	PowerShell	Collection Archive Collected Data	-	low	Timur Zinniatullin, oscd.community	2019-10-21	2023-12-15	6dc5d284-69ea-42cf-9311-fb1c3932a69a
	Detects execution of "tar.exe" in order to create a compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	Nasreddine Bencherchali (Nextron Systems), AdmU3	2023-12-19	—	418a3163-3247-4b7b-9933-dcfcb7c52ea9
	Detects execution of "tar.exe" in order to extract compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	AdmU3	2023-12-19	—	bf361876-6620-407a-812f-bfe11e51e924
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects a command used by conti to exfiltrate NTDS	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	2022-10-09	aa92fd02-09f2-48b0-8a93-864813fb8f41
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects disabling the CrashDump per registry (as used by HermeticWiper)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Persistence, Defense Impairment Modify Registry	-	medium	Tobias Michalski (Nextron Systems)	2022-02-24	2023-08-17	2ff692c2-4594-41ec-8fcb-46587de769e0
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript Stealth Obfuscated Files or Information Compile After Delivery Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2019-02-11	2026-03-23	b730a276-6b63-41b8-bcf8-55930c8fc6ee
	Detects Wscript/Cscript executing a file with an uncommon (i.e. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2023-06-19	99b7460d-c9f1-40d7-a316-1f36f61d52ee
	Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	CVE-2020-1048	high	EagleEye Team, Florian Roth (Nextron Systems), NVISO	2020-05-13	2024-03-25	7ec912f2-5175-4868-b811-ec13ad0f8567
	Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Jonhnathan Ribeiro, oscd.community	2020-10-16	2023-02-28	99cf1e02-00fb-4c0d-8375-563f978dfd37
Splunk	The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. (...)	Generic	stable	file_event	windows	Sysmon	Collection Archive Collected Data Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	7e3df743-b1d8-4631-8fa8-bd5819688876
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec	2022-03-18	2025-06-04	e2482f8d-3443-4237-b906-cc145d87a076
Splunk	The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	cd2cf33c-9201-11eb-a10a-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
Splunk	The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-05-13	39ebdc68-25b9-11ec-aec7-acde48001122
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
Splunk	The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-07	2026-05-13	1490f224-ad8b-11eb-8c4f-acde48001122
	Detect set UseActionCenterExperience to 0 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	3ae1a046-f7db-439d-b7ce-b8b366b81fa6
Splunk	The following analytic detects modifications to the registry that disable the CMD prompt application. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	ff86077c-9212-11eb-a1e6-acde48001122

Title

Description

Exaramel for Windows S0343

Exaramel for Windows S0343

Exaramel for Windows MITRE reference S0343

Standing S0343

Reach

Coverage

Exaramel for Windows detections S0343