malware
Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Valak can use the Registry for code updates and to collect credentials.4
Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.5
Valak has the ability to base64 encode and XOR encrypt strings.678
Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.101112
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
95th percentile · 95% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
98th percentile · 98% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
61st percentile · 61% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
1267 distinct rules cover the 34 techniques recorded for this malware. 826 Sigma · 441 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detects file access requests to the Windows Credential History File by an uncommon application. (...) | Generic | test | file_access | windows | - | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-17 | 2024-07-29 | 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 | ||||
Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. (...) | Generic | test | file_access | windows | - | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-17 | 2026-07-28 | 46612ae6-86be-4802-bc07-39b59feb1309 | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory. | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2022-03-17 | 2023-07-08 | 36bed6b2-e9a0-4fff-beeb-413a92b86138 | ||||
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | 2025-07-09 | 9212f354-7775-4e28-9c9f-8f0a4544e664 | ||||
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | — | e5d36acd-acb4-4c6f-a13f-9eb203d50099 | ||||
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs | Generic | test | - | windows | WinEventLog Security | - | high | Samir Bousseaden | 2019-04-03 | 2022-07-13 | 35ba1d85-724d-42a3-889f-2e2362bcaf23 | ||||
Splunk | The following analytic detects suspicious registry modifications that implement auto admin logon by adding DefaultUserName and DefaultPassword values. (...) | Anomaly | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-09-06 | 2026-05-13 | d4a3eb62-0f1e-11ec-a971-acde48001122 | |||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...) | Generic | experimental | file_event | windows | Sysmon | - | medium | Arnim Rupp (Nextron Systems), Thomas Patzke | 2025-07-09 | — | 0a1255c5-d732-4b62-ac02-b5152d34fb83 | ||||
Splunk | The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | de7fcadc-04f3-11ec-a241-acde48001122 | |||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-10-09 | 1fac1481-2dbc-48b2-9096-753c49b4ec71 | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-12-02 | 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | ps_module | windows | PowerShell | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-08-11 | 2025-10-17 | 64e8e417-c19a-475a-8d19-98ea705394cc | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g, Tim Shelton | 2019-09-12 | 2025-10-07 | 58cb02d5-78ce-4692-b3e1-dce850aae41a | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sreeman | 2020-03-13 | 2022-04-14 | 24de4f3b-804c-4165-b442-5a06a2302c7e | ||||
Splunk | The following analytic detects a suspicious registry modification that enables auto admin logon on a host. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-09-06 | 2026-05-13 | 1379d2b8-0f18-11ec-8ca3-acde48001122 | |||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2021-07-28 | 2022-12-25 | c1dda054-d638-4c16-afc8-53e007f3fbc5 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-28 | 2022-11-11 | f576a613-2392-4067-9d1a-9345fb58d8d1 | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Splunk | The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | e4384bbf-5835-4831-8d85-694de6ad2cc6 | |||
Splunk | The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-24 | 2026-05-13 | 04455dd3-ced7-480f-b8e6-5469b99e98e2 | |||
Splunk | The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2 | |||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Splunk | The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...) | Generic | stable | authentication | - | Microsoft 365 | - | medium | Mauricio Velazco, Gowthamaraj Rajendran, Splunk | 2023-11-16 | 2026-05-13 | d68d8732-6f7e-4ee5-a6eb-737f2b990b91 | |||
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | ff151c33-45fa-475d-af4f-c2f93571f4fe | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | 1d2ab8ac-1a01-423b-9c39-001510eae8e8 | ||||
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cob (...) | Generic | test | ps_module | windows | PowerShell | - | critical | ok @securonix invrep_de, oscd.community | 2020-10-09 | 2022-12-25 | 8d31a8ce-46b5-4dd6-bdc3-680931f1db86 | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Splunk | The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...) | Anomaly | stable | file_event | windows | Sysmon | - | medium | Steven Dick, Michael Haag, Rico Valdez, Splunk | 2020-04-29 | 2026-07-02 | 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 | - | ||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 |
45th percentile · 55% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 34 Enterprise techniques.
Technique Campaign use over its cumulative rule count.