malware

HOPLIGHT S0376

Type: malware
Platform: Windows
Created: 19 April 2019
Last modified: 22 October 2025

HOPLIGHT is a backdoor Trojan that has reportedly been used by the North Korean government.[1]

TechniquesTop 18%

TacticsTop 6%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0376

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .	Emerging	stable	antivirus	-	-	Privilege Escalation, Stealth Process Injection	CVE-2021-1675 CVE-2021-34527	critical	Sittikorn S, Nuttakorn T, Tim Shelton	2021-07-01	2023-10-23	6fe1719e-ecdf-4caf-bffe-4f501cb0a561
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under (...)	Emerging	test	image_load	windows	Sysmon	Privilege Escalation, Stealth Process Injection	-	high	Florian Roth (Nextron Systems)	2021-09-07	2022-10-09	33a2d1dd-f3b0-40bd-8baf-7974468927cc
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	Detects identities generating anomalously large model responses relative to their own historical baseline. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	a839a6f7-aaac-438b-9d99-be0b49481e17
Splunk	Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	989b3702-1df3-4076-9e2f-8dcbcc2b4bef
Splunk	This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	54734442-955a-4427-9a86-2d9712151067
Splunk	This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. (...)	Hunting	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	9e162548-3e9a-4a74-9eb5-34ee28350f07
Splunk	This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	39346724-a73a-4e01-8e93-4f4791e1a0bb
Splunk	This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-08	95fbdd4e-1202-4971-b85a-513b2005086e
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	ff151c33-45fa-475d-af4f-c2f93571f4fe
	This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	1d2ab8ac-1a01-423b-9c39-001510eae8e8
Splunk	The following analytic detects the assignment of the Privileged Authentication Administrator role to an Azure AD user. (...)	Generic	stable	account_management	-	Microsoft 365	Credential Access OS Credential Dumping Security Account Manager	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-04-25	2026-05-13	a7da845d-6fae-41cf-b823-6c0b8c55814a
Splunk	The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. (...)	Generic	stable	service	-	Microsoft 365	Credential Access OS Credential Dumping Security Account Manager	-	medium	Mauricio Velazco, Splunk	2024-02-14	2026-05-13	5521f8c5-1aa3-473c-9eb7-853701924a06
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	All TCP traffic on particular port from attacker is routed to different port. (...)	Generic	test	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify System Firewall	-	medium	Rafal Piasecki	2022-08-10	—	70b4156e-50fc-4523-aa50-c9dddf1993fc
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
Splunk	The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...)	Anomaly	stable	process_creation	-	Cisco	Command and Control Ingress Tool Transfer	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-10-02	c16c4899-d3f7-461b-92c2-cc0ef5758855
Splunk	This analytic detects network connections initiated by binaries that are not typically associated wi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Stealth Masquerading Privilege Escalation, Stealth Process Injection	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	c6db35af-8a0e-4b61-88ed-738e66f15715
Splunk	The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port. (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	fc32a8d5-bc79-4437-b48f-4646ab7bed9d
Splunk	This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...)	Generic	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	cd0e816f-f67d-4dbe-a153-480b546e867e

Title

Description

HOPLIGHT S0376

HOPLIGHT MITRE reference S0376

Standing S0376

Reach

Coverage

HOPLIGHT detections S0376