malware
WindTail is a macOS surveillance implant used by Windshift. WindTail shares code similarities with Hack Back aka KitM OSX.[1][2][3]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
WindTail can be delivered as a compressed, encrypted, and encoded payload.4
WindTail can be delivered as a compressed, encrypted, and encoded payload.5
WindTail has used icons mimicking MS Office files to mask payloads.6
WindTail has been incompletely signed with revoked certificates.7
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.8
WindTail can use the open command to execute an application.9
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
66th percentile · 66% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
53rd percentile · 53% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
47th percentile · 53% of 825 ATT&CK software entries have more detection rules per technique.
309 distinct rules cover the 15 techniques recorded for this malware. 221 Sigma · 88 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-08-17 | 2026-05-13 | 01d29b48-ff6f-11eb-b81e-acde48001123 | |||
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-27 | 2026-06-05 | ec570e53-4c76-45a9-804d-dc3f355ff7a7 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Splunk | The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Teoderick Contreras, Splunk | 2021-04-22 | 2026-05-13 | 9364ee8e-a39a-11eb-8f1d-acde48001122 | |||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2021-07-28 | 2022-12-25 | c1dda054-d638-4c16-afc8-53e007f3fbc5 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-28 | 2022-11-11 | f576a613-2392-4067-9d1a-9345fb58d8d1 | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Splunk | The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | e4384bbf-5835-4831-8d85-694de6ad2cc6 | |||
Splunk | The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-24 | 2026-05-13 | 04455dd3-ced7-480f-b8e6-5469b99e98e2 | |||
Splunk | The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2 | |||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
detects BPFDoor .lock and .pid files access in temporary file storage facility | Generic | test | file_event | linux | Linux Auditd | - | high | Rafal Piasecki | 2022-08-10 | 2026-03-30 | 808146b2-9332-4d78-9416-d7e47012d83d | ||||
Detects the usage of the unsafe bpftrace option | Generic | test | process_creation | linux | Sysmon | - | medium | Andreas Hunkeler (@Karneades) | 2022-02-11 | — | f8341cb2-ee25-43fa-a975-d8a5a9714b39 | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b | |||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Splunk | This analytic detects network connections initiated by binaries that are not typically associated wi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | c6db35af-8a0e-4b61-88ed-738e66f15715 | |||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 3d8536b6-52b4-4c3e-b695-3f2e90bb22be | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-01-24 | — | 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d | ||||
Detects a CodePage modification using the "mode.com" utility. (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk | 2024-01-19 | — | d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e | ||||
Detects a CodePage modification using the "mode.com" utility to Russian language. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Joseliyo Sanchez, @Joseliyo_Jstnk | 2024-01-17 | — | 12fbff88-16b5-4b42-9754-cd001a789fb3 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2026-06-05 | 9fbf5927-5261-4284-a71d-f681029ea574 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2022-12-25 | e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 |
42nd percentile · 58% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 15 Enterprise techniques.
Technique Campaign use over its cumulative rule count.