malware
Crutch is a backdoor designed for document theft that has been used by Turla since at least 2015.[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Crutch has used a hardcoded GitHub repository as a fallback channel.3
Crutch has automatically exfiltrated stolen files to Dropbox.4
Crutch can monitor removable drives and exfiltrate files matching a given extension list.5
Crutch has established persistence with a scheduled task impersonating the Outlook item finder.6
Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).7
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
66th percentile · 66% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
25th percentile · 75% of 825 ATT&CK software entries have more detection rules per technique.
366 distinct rules cover the 15 techniques recorded for this malware. 267 Sigma · 99 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-08-17 | 2026-05-13 | 01d29b48-ff6f-11eb-b81e-acde48001123 | |||
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-27 | 2026-06-05 | ec570e53-4c76-45a9-804d-dc3f355ff7a7 | ||||
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Splunk | The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Teoderick Contreras, Splunk | 2021-04-22 | 2026-05-13 | 9364ee8e-a39a-11eb-8f1d-acde48001122 | |||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27 | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2018-09-03 | 2023-03-09 | 9aa01d62-7667-4d3b-acb8-8cb5103e2014 | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...) | Generic | test | image_load | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-01-22 | 2023-03-15 | 90ae0469-0cee-4509-b67f-e5efcef040f7 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2021-07-28 | 2022-12-25 | c1dda054-d638-4c16-afc8-53e007f3fbc5 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-28 | 2022-11-11 | f576a613-2392-4067-9d1a-9345fb58d8d1 | ||||
Detects bulk downloading of User Data associated with AWS EC2 instances. (...) | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | faloker | 2020-02-11 | 2023-03-24 | 26ff4080-194e-47e7-9889-ef7602efed0c | ||||
An attempt to export an AWS EC2 instance has been detected. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Diogo Braz | 2020-04-16 | 2022-10-05 | 54b9a76a-3c71-4673-b4b3-2edb4566ea7b | ||||
Splunk | The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | e4384bbf-5835-4831-8d85-694de6ad2cc6 | |||
Splunk | The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-24 | 2026-05-13 | 04455dd3-ced7-480f-b8e6-5469b99e98e2 | |||
Splunk | The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2 | |||
Detects the change of database master password. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | faloker | 2020-02-12 | 2022-10-05 | 8a63cdd4-6207-414a-85bc-7e032bd3c1a2 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Detects execution of ChromeLoader malware via a registered scheduled task | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | @kostastsale | 2022-01-10 | — | 0a74c5a9-1b71-4475-9af2-7829d320d5c2 | ||||
Splunk | This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c | |||
Splunk | This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b | |||
Collect pertinent data from the configuration files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-11 | 2023-01-04 | cd072b25-a418-4f98-8ebc-5093fb38fe1a | ||||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | This detection identifies execution of the file synchronization utility "rclone". (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Nasreddine Bencherchali, Splunk | 2025-05-12 | 2026-09-22 | b71e57e8-c571-4ff1-ae13-bc4384a9e891 | |||
Splunk | This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 66f22f52-fbae-4be7-a263-561dacb63613 | |||
Splunk | This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 66f22f52-fbae-4be7-a263-561dacb63612 | |||
Splunk | The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 3d8536b6-52b4-4c3e-b695-3f2e90bb22be | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
Splunk | This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...) | Generic | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | 1abce487-f480-4d5f-a551-01de0bece0bd | ||||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2026-06-05 | 9fbf5927-5261-4284-a71d-f681029ea574 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2022-12-25 | e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID. | Generic | experimental | - | windows | WinEventLog System | - | medium | Jason Mull | 2025-05-12 | — | 882fbe50-d8d7-4e29-ae80-0648a8556866 | ||||
Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...) | Generic | test | file_event | windows | Sysmon | medium | Nasreddine Bencherchali (Nextron Systems), fornotes | 2022-12-01 | 2026-01-24 | df6ecb8b-7822-4f4b-b412-08f524b4576c | |||||
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking. | Generic | test | file_event | windows | Sysmon | - | medium | frack113 | 2022-05-09 | 2026-05-18 | 28a452f3-786c-4fd8-b8f2-bddbe9d616d1 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration. | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-03-29 | — | e328cc73-f92a-42fb-b3fa-7c2cffda981a | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 |
16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 15 Enterprise techniques.
Technique Campaign use over its cumulative rule count.