malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Netwalker's DLL has been embedded within the PowerShell script in hex format.2
Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.34
The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.6
Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.78
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.9
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
75th percentile · 75% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
87th percentile · 87% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
92nd percentile · 92% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 18 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
1222 distinct rules cover the 18 techniques recorded for this malware. 819 Sigma · 403 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2021-12-13 | 2024-05-10 | 639c9081-f482-47d3-a0bd-ddee3d4ecd76 | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | ps_module | windows | PowerShell | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-08-11 | 2025-10-17 | 64e8e417-c19a-475a-8d19-98ea705394cc | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g, Tim Shelton | 2019-09-12 | 2025-10-07 | 58cb02d5-78ce-4692-b3e1-dce850aae41a | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects loading of Amsi.dll by uncommon processes | Hunting | test | image_load | windows | Sysmon | - | low | frack113 | 2023-03-12 | 2026-06-29 | facd1549-e416-48e0-b8c4-41d7215eedc8 | ||||
Detects a highly relevant Antivirus alert that reports ransomware. (...) | Generic | test | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2022-05-12 | 2026-06-15 | 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
An application has been removed. (...) | Generic | test | - | windows | WinEventLog Application | - | low | frack113 | 2022-01-28 | 2022-09-17 | 570ae5ec-33dc-427c-b815-db86228ad43e | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2020-10-27 | 2026-05-13 | 16ae9076-d1d5-411c-8fdd-457504b33dac | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-10-04 | 2026-05-13 | f32598bb-fa5f-4afd-8ab3-0263cc28efbc | |||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | c79c164f-4b21-4847-98f9-cf6a9f49179e | |||
Splunk | The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | 884a5f59-eec7-4f4a-948b-dbde18225fdc | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-05-01 | 2026-05-13 | 657902a9-987d-4879-a1b2-e7a65512824b | |||
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-06-29 | 2021-08-20 | 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | toopricey | 2025-10-18 | — | 1279262f-1464-422f-ac0d-5b545320c526 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects when S3 bucket versioning is disabled. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sean Johnstone | Unit 42 | 2023-10-28 | — | a136ac98-b2bc-4189-a14d-f0d0388e57a7 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Identifies when a application is deleted in Azure. | Generic | test | cloud_audit | - | Azure Audit Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-09-03 | 2026-04-30 | 410d2a41-1e6d-452f-85e5-abdd8257a823 | ||||
Detects when a Container Registry is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 93e0ef48-37c8-49ed-a02c-038aab23628e | ||||
Detects when a Azure Kubernetes Cluster is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 9541f321-7cba-4b43-80fc-fbd1fb922808 | ||||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Identifies when a Azure Kubernetes network policy is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 08d6ac24-c927-4469-b3b7-2e422d6e3c43 | ||||
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 25cb259b-bbdc-4b87-98b7-90d7c72f8743 |