malware

FrameworkPOS S0503

Type: malware
Created: 8 September 2020
Last modified: 25 April 2025

FrameworkPOS is a point of sale (POS) malware used by FIN6 to steal payment card data from sytems that run physical POS devices.[1]

TechniquesBottom 23%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0503

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects a copy command or a copy utility execution to or from an Admin share or remote	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Network Shared Drive Exfiltration Exfiltration Over Alternative Protocol Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali	2019-12-30	2025-10-22	855bc8b5-2ae8-402e-a9ed-b889e6df1900
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects the execution of the BCP utility in order to export data from the database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)	2024-08-20	—	c615d676-f655-46b9-b913-78729021e5d7
Splunk	The following analytic identifies potential DNS exfiltration using the nslookup application. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Teoderick Contreras, Splunk, Wouter Jansen	2021-04-22	2026-05-13	2452e632-9e0d-11eb-bacd-acde48001122
	Identifies IPs performing DNS lookups associated with common Tor proxies.	Generic	test	-	-	DNS · Zeek	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Saw Winn Naung , Azure-Sentinel	2021-08-15	2025-09-12	a8322756-015c-42e7-afb1-436e85ed3ff5
	One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	frack113	2022-02-13	2024-03-05	6a69f62d-ce75-4b57-8dce-6351eb55b362
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
Splunk	This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	2e155547-aaac-49d3-b0ef-ceabc31fd364	-
Splunk	The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Teoderick Contreras, Stanislav Miskovic, Splunk	2021-04-22	2026-08-24	0a69fdaa-a2b8-11eb-b16d-acde48001122
	Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data Staged Local Data Staging	-	medium	Nasreddine Bencherchali (Nextron Systems), frack113	2021-07-20	2022-10-09	85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
	Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. (...)	Hunting	experimental	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol	-	medium	frack113	2025-10-12	—	c1477deb-37cf-4439-9ffb-44499acb89d0
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	High rate of unique Fully Qualified Domain Names (FQDN) requests per root domain (eTLD+1) in short p (...)	Unsupported	unsupported	dns	-	-	Exfiltration Exfiltration Over Alternative Protocol	-	high	Daniil Yugoslavskiy, oscd.community	2019-10-21	2019-11-04	8198e9a8-e38f-4ba5-8f16-882b1c0f880e	-
	Detects large DNS domain names	Unsupported	unsupported	dns	-	-	Exfiltration Exfiltration Over Alternative Protocol	-	high	Daniil Yugoslavskiy, oscd.community	2019-10-21	2019-11-04	14aa0d9e-c70a-4a49-bdc1-e5cbc4fc6af7	-
Splunk	The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. (...)	Anomaly	stable	cloud_audit	-	Microsoft 365	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Exfiltration Over Web Service	-	medium	Steven Dick	2024-04-07	2026-05-13	63a8a537-36fd-4aac-a3ea-1a96afd2c871
	Detects instances where an SMB service on an OpenCanary node has had a file open request.	Generic	test	-	-	OpenCanary	Collection Data from Local System Lateral Movement Remote Services	-	high	Security Onion Solutions	2024-03-08	—	22777c9e-873a-4b49-855f-6072ab861a52
	Detects a command used by conti to dump database	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	high	frack113	2021-08-16	2023-05-04	2f47f1fd-0901-466e-a770-3b7092834a1b
	This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...)	Unsupported	unsupported	-	-	HTTP · Zeek	Collection Archive Collected Data Archive via Utility Collection Data from Local System	-	medium	Greg Howell, OTR (Open Threat Research)	2020-04-05	2023-03-24	0d47e3f6-357f-4534-928c-202631d065fa
	Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Process Discovery Execution Windows Management Instrumentation	-	medium	frack113	2022-01-01	2025-12-15	221b251a-357a-49a9-920a-271802777cc0
	DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel	Generic	test	ps_script	windows	PowerShell	Exfiltration Exfiltration Over Alternative Protocol	-	high	frack113	2022-01-07	—	d59d7842-9a21-4bc6-ba98-64bfe0091355
	Detects process discovery commands. (...)	Hunting	stable	process_creation	linux	Sysmon	Discovery Process Discovery	-	low	Ömer Günal, oscd.community, CheraaghiMilad	2020-10-06	2022-07-07	4e2f5868-08d4-413d-899f-dc2f1508627b
Splunk	The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. (...)	Anomaly	stable	network_connection	-	Cisco Secure Firewall · Cisco	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Rico Valdez, Splunk	2020-04-29	2026-09-22	ce5a0962-849f-4720-a678-753fe6674479
Splunk	This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation. (...)	Anomaly	stable	network_connection	-	Windchill Log4j	Execution Command and Scripting Interpreter Collection Data from Local System Initial Access Exploit Public-Facing Application	CVE-2026-4681	medium	Nasreddine Bencherchali, Splunk	2026-06-14	2026-06-14	d725b390-fe86-47df-b9a1-57497915403e
	Detects the execution of the Restic backup tool, which can be used for data exfiltration. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-17	—	6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
	Detects the execution of a potential recon command where the results are piped to "findstr". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Process Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), frack113	2023-07-06	2025-10-08	ccb5742c-c248-4982-8c5c-5571b9275ad3
	Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). (...)	Generic	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Collection Data from Local System Credential Access Unsecured Credentials	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-25	—	f0025a69-e1b7-4dda-a53c-db21fa2d4071
	Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Collection Data from Local System Credential Access Unsecured Credentials	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-25	—	0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Splunk	Detects creation of exfiltration artifact files associated with Shai-Hulud 2.0 npm supply chain malw (...)	Generic	stable	file_event	linux · windows	Sysmon	Collection Data Staged Local Data Staging Initial Access Supply Chain Compromise Compromise Software Supply Chain Credential Access Unsecured Credentials Credentials In Files	-	medium	Michael Haag, Splunk	2025-11-25	2026-05-13	9e7d3c0f-4a5b-6c8d-1e2f-3a4b5c6d7e8f
	Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.	Emerging	experimental	process_creation	linux	Sysmon	Collection Data from Local System Exfiltration Exfiltration Over C2 Channel	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-09-24	—	efd2eb09-b72e-4a61-8dc7-b1382a1e8983
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers Collection Data from Local System Credential Access Steal Web Session Cookie	-	high	TropChaud	2022-12-19	2023-01-19	24c77512-782b-448a-8950-eddb0785fc71
	Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System Credential Access Steal Web Session Cookie	-	high	frack113	2022-04-08	2023-01-19	4833155a-4053-4c9c-a997-777fcea0baa7
Splunk	The following analytic detects the creation of sqlite3.dll files in the %temp% folder. (...)	Generic	stable	file_event	windows	Sysmon	Collection Data from Local System	-	medium	Teoderick Contreras, Splunk	2021-08-05	2026-05-13	0f216a38-f45f-11eb-b09c-acde48001122
	Get the processes that are running on the local computer.	Generic	test	ps_script	windows	PowerShell	Discovery Process Discovery	-	low	frack113	2022-03-17	—	af4c87ce-bdda-4215-b998-15220772e993
	Detects a suspicious output redirection to the local admins share, this technique is often found in (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol	-	high	Florian Roth (Nextron Systems)	2022-01-16	2023-12-28	ab9e3b40-0c85-4ba1-aede-455d226fd124
	Adversaries may attempt to get information about running processes on a system. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Process Discovery	-	informational	frack113	2021-12-11	2022-12-25	63332011-f057-496c-ad8d-d2b6afb27f96
	Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. (...)	Generic	experimental	process_creation	linux	Linux Auditd	Discovery Process Discovery Discovery System Information Discovery	-	low	Milad Cheraghi	2025-05-30	2025-12-05	b207d563-a1d9-4275-b349-77d1eb55aa6d
	Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. (...)	Emerging	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Alternative Protocol	-	medium	Leonardo Gasparini	2026-05-12	—	ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
	Well-known TAP software installation. (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Daniil Yugoslavskiy, Ian Davis, oscd.community	2019-10-24	2021-09-21	8bd47424-53e9-41ea-8a6a-a1f97b1bb0eb	-
	Well-known TAP software installation. (...)	Generic	test	service	windows	WinEventLog System	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Daniil Yugoslavskiy, Ian Davis, oscd.community	2019-10-24	2022-12-25	8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
	Detects the installation of a well-known TAP driver service. (...)	Generic	test	service	windows	WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol	-	low	Daniil Yugoslavskiy, Ian Davis, oscd.community	2019-10-24	2022-11-29	9c8afa4d-0022-48f0-9456-3712466f9701
	Well-known TAP software installation. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol	-	medium	Daniil Yugoslavskiy, Ian Davis, oscd.community	2019-10-24	2023-12-11	99793437-3e16-439b-be0f-078782cf953d
	Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-04	—	696bfb54-227e-4602-ac5b-30d9d2053312

Title

Description

FrameworkPOS S0503

FrameworkPOS S0503

FrameworkPOS MITRE reference S0503

Standing S0503

Reach

Coverage

FrameworkPOS detections S0503