defection.io

tool

Imminent Monitor S0434

Type: tool
Platform: Windows
Created: 5 May 2020
Last modified: 3 October 2023

Imminent Monitor was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.[1]

Techniques70th pct

TacticsTop 11%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

tool

Imminent Monitor S0434

Type: tool
Platform: Windows
Created: 5 May 2020
Last modified: 3 October 2023

Techniques70th pct

TacticsTop 11%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Imminent Monitor MITRE reference S0434

Remote Desktop Protocol T1021.001 ↗

Imminent Monitor has a module for performing remote desktop access.2

Lateral Movement33 detection rules

Obfuscated Files or Information T1027 ↗

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.3

Stealth117 detection rules

Exfiltration Over C2 Channel T1041 ↗

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.4

Exfiltration16 detection rules

Keylogging T1056.001 ↗

Imminent Monitor has a keylogging module.5

Credential Access · Collection3 detection rules

Process Discovery T1057 ↗

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.6

Discovery10 detection rules

Command and Scripting Interpreter T1059 ↗

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.7

Execution148 detection rules

Standing S0434

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1670th pct

70th percentile · 70% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics9Top 11%

89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat groups261% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique15med34th pct

34th percentile · 66% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique8.5med74th pct

74th percentile · 74% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 16 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 482Splunk ESCU (cumulative) · 243