malware

Kessel S0487

Type: malware
Platform: Linux
Created: 16 July 2020
Last modified: 11 April 2024

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.[1]

Techniques61st pct

TacticsTop 11%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0487

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations	Generic	test	image_load	windows	Sysmon	Execution Command and Scripting Interpreter	-	high	X__Junior (Nextron Systems)	2023-07-11	—	799a5f48-0ac1-4e0f-9152-71d137d48c2a
	Detects usage of winget to add a new insecure (http) download source. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	—	81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
	Detects usage of winget to add new additional download sources	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	—	05ebafc8-7aa2-4bcd-a269-2aec93f9e842
	Detects usage of winget to add new potentially suspicious download sources	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	2023-12-04	c15a46a0-07d4-4c87-b4b6-89207835a83b
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	high	Michael McIntyre @wtfender	2023-09-27	—	d3adb3ef-b7e7-4003-9092-1924c797db35
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Identifies when a new cloudshell is created inside of Azure portal.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Execution Command and Scripting Interpreter	-	medium	Austin Songer	2021-09-21	2022-08-23	72af37e2-ec32-47dc-992b-bc288a2708cb
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Monitor and alert on conditional access changes where non approved actor removed CA Policy.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Privilege Escalation Abuse Elevation Control Mechanism Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Corissa Koopmans, '@corissalea'	2022-07-19	—	26e7c5e2-6545-481e-b7e6-050143459635
	Monitor and alert on conditional access changes. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Privilege Escalation Abuse Elevation Control Mechanism Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Corissa Koopmans, '@corissalea'	2022-07-19	2024-05-28	50a3c7aa-ec29-44a4-92c1-fce229eef6fc
	Detects the use of the "capsh" utility to invoke a shell.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter	-	high	Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)	2024-09-02	—	db1ac3be-f606-4e3a-89e0-9607cbe6b98a
	Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Harjot Shah Singh, '@cyb3rjy0t'	2024-03-26	—	c2496b41-16a9-4016-a776-b23f8910dc58
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	AlertIQ	2021-10-10	2022-12-25	4d78a000-ab52-4564-88a5-7ab5242b20c7
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic identifies instances where a Duo admin logs in using a browser other than Chrome, which is considered unusual based on typical access patterns. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	b38932ad-e663-4e90-bfdf-8446ee5b3f34
Splunk	The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	1bf631d1-44a0-472b-98c4-2975b8b281df
Splunk	The following analytic identifies Duo admin login attempts from operating systems that are unusual for your environment, excluding commonly used OS such as Mac OS X. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	c4824cc6-d644-458e-a39a-67cd67da75e3
Splunk	The following analytic detects instances where a Duo administrator performs a bulk deletion of more than three policies in a single action. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	983be012-e408-4cb0-b87f-6756bb5f7047
Splunk	The following analytic detects when a Duo user generates a bypass code, which allows them to circumvent multi-factor authentication (2FA) protections. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	446e81ff-ce06-4925-9c7d-4073f9b5abf5
Splunk	The following analytic detects when a Duo policy is created or updated to allow devices without a screen lock requirement. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	114c616b-c793-465d-a80d-758c9fe8a704
Splunk	The following analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA). (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	2593f641-6192-4f3d-b96c-2bd1c706215f
Splunk	The following analytic identifies instances where a Duo administrator creates or updates a policy to allow the use of outdated Flash components, specifically by detecting policy changes with the flash_remediation=no remediation attribute. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	f36c0d3f-d57f-4b88-a5d4-0a4c9a0752f6
Splunk	The following analytic detects when a Duo policy is created or updated to allow the use of outdated (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	ff56d843-57de-4a87-b726-13b145f6bf96
Splunk	The following analytic detects when a Duo policy is created or updated to allow tampered or rooted d (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	6b813efd-8859-406f-b677-719458387fac
Splunk	The following analytic detects instances where a Duo policy is created or updated to allow access without two-factor authentication (2FA). (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	65862e8a-799a-4509-ae1c-4602aa139580
Splunk	The following analytic identifies instances where a Duo administrator creates or updates a policy to explicitly deny user access within the Duo environment. (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	abf39464-ed43-4d69-a56c-02750032a3fb
Splunk	The following analytic detects when a Duo policy is created or updated to allow access without two-f (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	ab59d5ee-8694-4832-a332-cefcf66a9057
Splunk	The following analytic detects instances where a Duo user's status is changed to "Bypass" for 2FA, s (...)	Generic	stable	authentication	-	Cisco Duo · Cisco	Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	Patrick Bareiss, Splunk	2025-07-10	2026-05-13	8728d224-9cd5-4aa7-b75f-f8520a569979
Splunk	This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Privilege Escalation Escape to Host	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	ff82a536-8fde-4963-a801-815826fcdf75
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	a113a8be-7386-46e0-a079-d9fd46f9631f
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
Splunk	The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...)	Anomaly	stable	process_creation	-	Cisco	Command and Control Ingress Tool Transfer	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-10-02	c16c4899-d3f7-461b-92c2-cc0ef5758855
Splunk	This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Initial Access, Persistence External Remote Services Persistence, Defense Impairment, Credential Access Modify Authentication Process Lateral Movement Remote Services	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	61ae09c2-079e-44b1-8be0-74e35c5a679e

Title

Description

Kessel S0487

Kessel MITRE reference S0487

Standing S0487

Reach

Coverage

Kessel detections S0487