malware

SoreFang S0516

Type: malware
Platform: Windows
Created: 29 September 2020
Last modified: 22 October 2025

SoreFang is first stage downloader used by APT29 for exfiltration and to load other malware.[1][2]

Techniques61st pct

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

SoreFang MITRE reference S0516

System Network Configuration Discovery T1016 ↗

SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.3

Discovery25 detection rules

Obfuscated Files or Information T1027 ↗

SoreFang has the ability to encode and RC6 encrypt data sent to C2.4

Stealth117 detection rules

Scheduled Task T1053.005 ↗

SoreFang can gain persistence through use of scheduled tasks.5

Execution · Persistence · Privilege Escalation79 detection rules

Process Discovery T1057 ↗

SoreFang can enumerate processes on a victim machine through use of Tasklist.6

Discovery10 detection rules

Domain Groups T1069.002 ↗

SoreFang can enumerate domain groups by executing net.exe group /domain.7

Discovery36 detection rules

Web Protocols T1071.001 ↗

SoreFang can use HTTP in C2 communications.8 9

Command and Control60 detection rules

Standing S0516

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1461st pct

61st percentile · 61% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique43.5medTop 12%

88th percentile · 88% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique11medTop 5%

95th percentile · 95% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0.5medBottom 23%

23rd percentile · 77% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 14 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 552Splunk ESCU (cumulative) · 272

Standing S0516

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-21887 CVE-2023-46805 CVE-2023-46085	medium	Michael Haag, Splunk	2024-01-17	2026-05-13	15838756-f425-43fa-9d88-a7f88063e81a
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory	Generic	test	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Domain Groups	-	low	frack113	2022-03-17	2022-11-17	8c3a6607-b7dc-4f0d-a646-ef38c00b76ee
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
Splunk	The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-29298 CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	d6821c0b-fcdc-4c95-a77f-e10752fae41a
Splunk	The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	695aceae-21db-4e7f-93ac-a52e39d02b93
	Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-40539	high	Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)	2021-09-20	2023-01-02	6702b13c-e421-44cc-ab33-42cc25570f11
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective	Emerging	test	process_creation	linux	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-20	—	c8a5f584-cdc8-42cc-8cce-0398e4265de3
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-19	2023-01-02	1a9a04fd-02d1-465c-abad-d733fd409f9c
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-20091 CVE-2021-20090	critical	Bhabesh Raj	2021-08-24	2023-01-02	f0500377-bc70-425d-ac8c-e956cd906871
	Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2022-36804	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-29	2023-01-02	65c0a0ab-d675-4441-bd6b-d3db226a2685
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2025-07-18	d4488827-73af-4f8d-9244-7b7662ef046e
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.	Emerging	experimental	proxy	-	-	Initial Access Exploit Public-Facing Application	CVE-2025-20362 CVE-2025-20333	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-20	—	15697955-6a29-47ca-92e9-0e05efae3260
	Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code o (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-3452	high	Florian Roth (Nextron Systems)	2021-01-07	2023-01-02	aba47adc-4847-4970-95c1-61dce62a8b29
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic identifies the potential exploitation of the Cisco IOS XE vulnerability, CVE-2023-20198, in the Web User Interface. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-20198	medium	Michael Haag, Splunk	2023-10-17	2026-05-13	07c36cda-6567-43c3-bc1a-89dff61e2cd9
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	a113a8be-7386-46e0-a079-d9fd46f9631f