malware

Cadelspy S0454

Type: malware
Platform: Windows
Created: 22 May 2020
Last modified: 25 April 2025

Cadelspy is a backdoor that has been used by APT39.[1]

Techniques38th pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Cadelspy MITRE reference S0454

Application Window Discovery T1010 ↗

Cadelspy has the ability to identify open windows on the compromised host.2

Discovery1 detection rules

Keylogging T1056.001 ↗

Cadelspy has the ability to log keystrokes on the compromised host.3

Credential Access · Collection3 detection rules

System Information Discovery T1082 ↗

Cadelspy has the ability to discover information about the compromised host.4

Discovery54 detection rules

Screen Capture T1113 ↗

Cadelspy has the ability to capture screenshots and webcam photos.5

Collection15 detection rules

Clipboard Data T1115 ↗

Cadelspy has the ability to steal data from the clipboard.6

Collection12 detection rules

Peripheral Device Discovery T1120 ↗

Cadelspy has the ability to steal information about printers and the documents sent to printers.7

Discovery2 detection rules

Standing S0454

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques838th pct

38th percentile · 62% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique8medBottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique4.5med32nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 8 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 70Splunk ESCU (cumulative) · 32

Standing S0454

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
	Detects access to clipboard content via osascript, which may be used for data collection but also oc (...)	Generic	test	process_creation	macos	-	Collection Clipboard Data Execution Command and Scripting Interpreter AppleScript	-	medium	Sohan G (D4rkCiph3r)	2023-01-31	2026-05-22	7794fa3c-edea-4cff-bec7-267dd4770fd7
	Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-10-01	2022-10-09	f200dc3f-b219-425d-a17e-c38467364816
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Sysmon	Collection Clipboard Data	-	low	Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-09-15	ec127035-a636-4b9a-8555-0efd4e59f316
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-09-24	2022-11-26	214e7e6c-f21b-47ff-bb6f-551b2d143fcf
	Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. (...)	Hunting	test	process_creation	macos	-	Collection Clipboard Data	-	medium	Daniel Cortez	2024-07-30	—	d8af0da1-2959-40f9-a3e4-37a6aa1228b7
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. (...)	Hunting	test	ps_script	windows	PowerShell	Collection Archive Collected Data	-	low	Timur Zinniatullin, oscd.community	2019-10-21	2023-12-15	6dc5d284-69ea-42cf-9311-fb1c3932a69a
	Detects execution of "tar.exe" in order to create a compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	Nasreddine Bencherchali (Nextron Systems), AdmU3	2023-12-19	—	418a3163-3247-4b7b-9933-dcfcb7c52ea9
	Detects execution of "tar.exe" in order to extract compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	AdmU3	2023-12-19	—	bf361876-6620-407a-812f-bfe11e51e924
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects a command used by conti to exfiltrate NTDS	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	2022-10-09	aa92fd02-09f2-48b0-8a93-864813fb8f41
	Detects the execution of clip.exe in order to copy data to the clipboard. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Clipboard Data	-	low	frack113	2021-07-27	2023-02-21	ddeff553-5233-4ae9-bbab-d64d2bd634be
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
Splunk	The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. (...)	Generic	stable	file_event	windows	Sysmon	Collection Archive Collected Data Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	7e3df743-b1d8-4631-8fa8-bd5819688876
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Attackers may leverage fsutil to enumerated connected drives.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Peripheral Device Discovery	-	low	Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2022-03-29	2022-07-14	63de06b9-a385-40b5-8b32-73f2b9ef84b6
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Network Service Discovery Discovery System Information Discovery	-	high	Georg Lauenstein (sure[secure])	2022-09-19	2023-03-23	98b53e78-ebaf-46f8-be06-421aafd176d9
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	medium	Teoderick Contreras, Splunk	2022-06-17	2026-10-02	9ddfe470-c4d0-4e60-8668-7337bd699edd
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. (...)	Anomaly	stable	process_creation	linux	Sysmon	Collection Clipboard Data	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-02	7173b2ad-6146-418f-85ae-c3479e4515fc
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
	Detect attempt to enable auditing of TTY input	Generic	test	file_event	linux	Linux Auditd	Credential Access, Collection Input Capture Keylogging Credential Access OS Credential Dumping	-	high	Pawel Mazur	2021-05-24	2022-12-18	49aae26c-450e-448b-911d-b3c13d178dfc
	Detects a set of suspicious network related commands often used in recon stages	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2022-02-07	—	e6313acd-208c-44fc-a0ff-db85d572e90e
	Detects instances where an SIP service on an OpenCanary node has had a SIP request.	Generic	test	-	-	OpenCanary	Collection Audio Capture	-	high	Security Onion Solutions	2024-03-08	—	e30de276-68ec-435c-ab99-ef3befec6c61
	Detects the use of grep to identify information about the operating system architecture. (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	d27ab432-2199-483f-a297-03633c05bae6
	Detects the enabling of the "EnablePeriodicBackup" registry value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-01	—	973ef012-8f1a-4c40-93b4-7e659a5cd17f
	Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	2025-11-24	43e26eb5-cd58-48d1-8ce9-a273f5d298d8
	Detects the use of grep to discover specific files created by the GobRAT malware	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	e34cfa0c-0a50-4210-9cb3-5632d08eb041
	Detects PowerShell scripts that contains reference to keystroke capturing functions	Generic	test	ps_script	windows	PowerShell	Credential Access, Collection Input Capture Keylogging	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-01-04	—	965e2db9-eddb-4cf6-a986-7a967df651e4
	Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2023-02-14	2025-03-17	e568650b-5dcd-4658-8f34-ded0b1e13992
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	A General detection for the Get-Clipboard commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Collection Clipboard Data	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-01-04	4cbd4f12-2e22-43e3-882f-bff3247ffb78
	Detects usage of the 'Get-Clipboard' cmdlet via CLI	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Clipboard Data	-	medium	Nasreddine Bencherchali (Nextron Systems)	2020-05-02	2022-12-25	b9aeac14-2ffd-4ad3-b967-1354a4e628c3
	Adversaries may log user keystrokes to intercept credentials as the user types them.	Generic	test	ps_script	windows	PowerShell	Credential Access, Collection Input Capture Keylogging	-	medium	frack113	2021-07-30	2022-07-11	34f90d3c-c297-49e9-b26d-911b05a4866c
	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.	Generic	test	ps_script	windows	PowerShell	Discovery Peripheral Device Discovery	-	low	frack113	2021-08-23	2022-12-25	b26647de-4feb-4283-af6b-6117661283c5
	Potential adversaries accessing the microphone and webcam in an endpoint.	Generic	test	registry_event	windows	WinEventLog Security	Collection Audio Capture	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-07	2021-11-27	8cd538a4-62d5-4e83-810b-12d41e428d6e
	Detects the execution of System Informer, a task manager tool to view and manipulate processes, kern (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Stealth Hide Artifacts Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems)	2023-05-08	2024-11-23	5722dff1-4bdd-4949-86ab-fbaf707e767a

Title

Description