NotPetya S0368

Type: malware
Platform: Windows
Created: 26 March 2019
Last modified: 16 April 2025

NotPetya is malware that was used by Sandworm Team in a worldwide attack starting on June 27, 2017. While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.[1][2][3][4]

Techniques61st pct

TacticsTop 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

NotPetya S0368

Type: malware
Platform: Windows
Created: 26 March 2019
Last modified: 16 April 2025

Techniques61st pct

TacticsTop 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

NotPetya MITRE reference S0368

LSASS Memory T1003.001 ↗

NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.5 6 7

Credential Access90 detection rules

SMB/Windows Admin Shares T1021.002 ↗

NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.8 9 10

Lateral Movement54 detection rules

Masquerading T1036 ↗

NotPetya drops PsExec with the filename dllhost.dat.11

Stealth53 detection rules

Windows Management Instrumentation T1047 ↗

NotPetya can use wmic to help propagate itself across a network.12 13

Execution71 detection rules

Scheduled Task T1053.005 ↗

NotPetya creates a task to reboot the system one hour after infection.14

Execution · Persistence · Privilege Escalation79 detection rules

Local Accounts T1078.003 ↗

NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.15 16

Initial Access · Persistence · Privilege Escalation · Stealth11 detection rules

NotPetya detections S0368

552 distinct rules cover the 14 techniques recorded for this malware. 407 Sigma · 145 Splunk.

14 covered by at least one rule552 distinct rules in total

Showing 1-50 of 500+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects access to ADMIN$ network share	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	low	Florian Roth (Nextron Systems)	2017-03-04	2024-01-16	098d7118-55bc-4912-a836-dc6483a8d150
Splunk	The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. (...)	Correlation	stable	-	-	-	Lateral Movement Exploitation of Remote Services	-	medium	Michael Haag, Splunk	2023-04-19	2026-05-13	6aa6f9dd-adfe-45a8-8f74-c4c7a0d7d037
	Detect remote login by Administrator user (depending on internal pattern).	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Default Accounts Domain Accounts Local Accounts	-	low	juju4	2017-10-29	2022-10-09	0f63e1ef-1eb9-4226-9d54-8927ca08520a
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects attackers using tooling with bad opsec defaults. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)	2020-10-23	2024-08-15	a7c3d773-caef-227e-a7e7-c2f13c622329
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
Splunk	This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence, Privilege Escalation Account Manipulation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	5f7d8c3e-9a2b-4d6f-8e1c-3b5a9d7f2c4e
	Detect a system being shutdown or put into different boot mode	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Stored Data Manipulation Impact Firmware Corruption Impact System Shutdown/Reboot	-	medium	Austin Clark	2019-08-15	2023-01-04	d94a35f0-7a29-45f6-90a0-80df6159967c	-
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	e20a6709-5f2c-4508-83fb-b3af6f705717
Splunk	This analytic detects network connections initiated by binaries that are not typically associated wi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Stealth Masquerading Privilege Escalation, Stealth Process Injection	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	c6db35af-8a0e-4b61-88ed-738e66f15715
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Impact Endpoint Denial of Service Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Bhavin Patel, Michael Haag, Splunk	2025-04-16	2026-05-13	7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Wojciech Lesicki	2021-06-01	2022-09-16	ae9c6a7c-9521-42a6-915e-5aaa8689d529
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	medium	Julia Fomina, oscd.community	2020-10-05	2023-02-09	9386d78a-7207-4048-9c9f-a93a7c2d1c05
	Detects a CodePage modification using the "mode.com" utility. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	low	Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-19	—	d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
	Detects a CodePage modification using the "mode.com" utility to Russian language. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-17	—	12fbff88-16b5-4b42-9754-cd001a789fb3
	Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-08	2023-02-14	9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
	Detects a copy command or a copy utility execution to or from an Admin share or remote	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Network Shared Drive Exfiltration Exfiltration Over Alternative Protocol Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali	2019-12-30	2025-10-22	855bc8b5-2ae8-402e-a9ed-b889e6df1900
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
Splunk	The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). (...)	Generic	stable	create_remote_thread	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-06-29	67d4dbef-9564-4699-8da8-03a151529edc
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
Splunk	The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. (...)	Generic	stable	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2019-12-11	2026-10-02	b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
	Files with well-known filenames (parts of credential dump software or files produced by them) creati (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager NTDS LSA Secrets	-	high	Teymur Kheirkhabarov, oscd.community	2019-11-01	2025-10-25	8fbf3271-1ef6-4e94-8210-03c2317947f6
	Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj, Jonhnathan Ribeiro	2023-11-27	2023-11-29	f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
	Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-06-27	2023-11-29	e5b33f7d-eb93-48b6-9851-09e1e610b6d7
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52

...

NotPetya S0368

NotPetya S0368

NotPetya MITRE reference S0368

NotPetya MITRE reference S0368

Standing S0368

Reach

Coverage

NotPetya detections S0368