malware

Raindrop S0565

Type: malware
Platform: Windows
Created: 19 January 2021
Last modified: 11 April 2024

Raindrop is a loader used by APT29 that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was discovered in January 2021 and was likely used since at least May 2020.[1][2]

Techniques33rd pct

TacticsBottom 12%

Threat groupunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0565

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	This analytic detects network connections initiated by binaries that are not typically associated wi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Stealth Masquerading Privilege Escalation, Stealth Process Injection	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	c6db35af-8a0e-4b61-88ed-738e66f15715
	Detects a CodePage modification using the "mode.com" utility. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	low	Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-19	—	d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
	Detects a CodePage modification using the "mode.com" utility to Russian language. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-17	—	12fbff88-16b5-4b42-9754-cd001a789fb3
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	medium	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2022-04-06	2023-04-12	dee0a7a3-f200-4112-a99b-952196d81e42
Splunk	The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. (...)	Anomaly	stable	file_event	windows	Sysmon	Stealth Masquerading	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-08-14	a7e3f0f0-ae42-11eb-b245-acde48001122
Splunk	The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. (...)	Anomaly	stable	file_event	windows	Sysmon	Stealth Masquerading	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-08-14	e0422b71-2c05-4f32-8754-01fb415f49c9
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, whic (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber	2019-06-29	2025-10-31	949f1ffb-6e85-4f00-ae1e-c3c5b190d605
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Stealth Obfuscated Files or Information Steganography	-	medium	Trent Liffick	2020-05-01	2024-01-15	33339be3-148b-4e16-af56-ad16ec6c7e7b
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	high	Nasreddine Bencherchali (Nextron Systems), Anish Bogati	2024-01-05	—	f53714ec-5077-420e-ad20-907ff9bb2958
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects suspicious use of XORDump process memory dumping utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-01-28	2023-02-08	66e563f9-1cbd-4a22-a957-d8b7c0f44372
	Detects suspicious interactive bash as a parent to rather uncommon child processes	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Stealth Masquerading	-	medium	Florian Roth (Nextron Systems)	2022-03-14	—	ea3ecad2-db86-4a89-ad0b-132a10d2db55
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
Splunk	The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof. (...)	Anomaly	stable	file_event	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Stealth Masquerading	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	a806d611-ea81-4d8a-9b9b-fbf5b6ec520a
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
Splunk	The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. (...)	Anomaly	stable	file_event	linux	Sysmon	Stealth Masquerading	CVE-2025-32463	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	250fd1b5-e62a-4515-baff-3010b52b4c12
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects the creation of a user with the "$" character. (...)	Generic	test	account_management	windows	WinEventLog Security	Stealth Masquerading	-	medium	Ilyas Ochkov, oscd.community	2019-10-25	2024-01-16	cfeed607-6aa4-4bbd-9627-b637deb723c8
	Detects the creation of a process via the Windows task manager. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	low	Florian Roth (Nextron Systems)	2018-03-13	2024-01-18	3d7679bd-0c00-440c-97b0-3f204273e6c7
	Detects the extraction of password protected ZIP archives with suspicious file names. (...)	Generic	test	-	windows	WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Masquerading Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2022-05-09	—	54f0434b-726f-48a1-b2aa-067df14516e4
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
Splunk	The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution. (...)	Anomaly	stable	process_creation	windows	Sysmon	Stealth, Discovery Virtualization/Sandbox Evasion Time Based Checks	-	medium	Teoderick Contreras, Splunk	2022-01-20	2026-10-09	ce058d6c-79f2-11ec-b476-acde48001122
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects binaries that use the same name as legitimate sysinternals tools to evade detection. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2021-12-20	2025-04-12	7cce6fc8-a07f-4d84-a53e-96e1879843c9
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Christian Burkard (Nextron Systems)	2021-10-26	2023-03-29	1327381e-6ab0-4f38-b583-4c1b8346a56b
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Sreeman	2020-04-17	2024-02-08	4e762605-34a8-406d-b72e-c1a089313320
	Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Rename Legitimate Utilities	-	medium	Micah Babinski, @micahbabinski	2023-05-07	—	32e280f1-8ad4-46ef-9e80-910657611fbc
	Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Rename Legitimate Utilities	-	medium	Micah Babinski, @micahbabinski	2023-05-08	—	4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
	Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2018-10-30	2025-10-19	5afee48e-67dd-4e03-a783-f74259dcf998
	Detects the execution of msiexec.exe from an uncommon directory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Florian Roth (Nextron Systems)	2019-11-14	2023-02-21	e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
	Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	X__Junior (Nextron Systems)	2023-06-30	—	fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
	Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-01-11	2023-05-09	79b06761-465f-4f88-9ef2-150e24d3d737
	Detects the modification of the wsl.exe binary from its installed location. (...)	Generic	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	2f400434-01e1-416b-b52c-bb5bfbb9eb78
	Detects a potentially suspicious execution of a process located in the '/tmp/' folder	Generic	test	process_creation	linux	Sysmon	Stealth Masquerading	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	2025-08-05	312b42b1-bded-4441-8b58-163a3af58775

Title

Description

Raindrop S0565

Raindrop S0565

Raindrop MITRE reference S0565

Standing S0565

Reach

Coverage

Raindrop detections S0565