malware
Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
70th percentile · 70% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
81st percentile · 81% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
1223 distinct rules cover the 16 techniques recorded for this malware. 811 Sigma · 412 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...) | Generic | stable | process_access | windows | Sysmon | - | medium | Patrick Bareiss, Splunk | 2019-12-11 | 2026-10-09 | fb4c31b0-13e8-4155-8aa5-24de4b8d6717 | |||
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password. | Generic | test | authentication | - | Azure Sign-in Logs · Azure | - | medium | AlertIQ | 2021-10-10 | 2022-12-25 | 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detects the use of Advanced IP Scanner. (...) | Generic | test | file_event | windows | Sysmon | - | medium | @ROxPinTeddy | 2020-05-12 | 2022-11-29 | fed85bf9-e075-4280-9159-fbe8a023d6fa | ||||
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2021-12-13 | 2024-05-10 | 639c9081-f482-47d3-a0bd-ddee3d4ecd76 | ||||
Splunk | The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-05-26 | 2026-05-13 | 0a46537c-be02-11eb-92ca-acde48001122 | |||
Splunk | The following analytic detects a suspicious PowerShell command that allows inbound traffic to a specific local port within the public profile. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Splunk | 2021-05-19 | 2026-05-13 | a5d85486-b89c-11eb-8267-acde48001122 | |||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | ps_module | windows | PowerShell | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-08-11 | 2025-10-17 | 64e8e417-c19a-475a-8d19-98ea705394cc | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g, Tim Shelton | 2019-09-12 | 2025-10-07 | 58cb02d5-78ce-4692-b3e1-dce850aae41a | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects loading of Amsi.dll by uncommon processes | Hunting | test | image_load | windows | Sysmon | - | low | frack113 | 2023-03-12 | 2026-06-29 | facd1549-e416-48e0-b8c4-41d7215eedc8 | ||||
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Detects a highly relevant Antivirus alert that reports ransomware. (...) | Generic | test | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2022-05-12 | 2026-06-15 | 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
An application has been removed. (...) | Generic | test | - | windows | WinEventLog Application | - | low | frack113 | 2022-01-28 | 2022-09-17 | 570ae5ec-33dc-427c-b815-db86228ad43e | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Splunk | The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-08-07 | 2026-05-13 | d15e9bd9-ef64-4d84-bc04-f62955a9fee8 | |||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2020-10-27 | 2026-05-13 | 16ae9076-d1d5-411c-8fdd-457504b33dac | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-10-04 | 2026-05-13 | f32598bb-fa5f-4afd-8ab3-0263cc28efbc | |||
Splunk | The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-10-04 | 2026-05-13 | 726959fe-316d-445c-a584-fa187d64e295 | |||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Splunk | The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco | - | medium | Bhavin Patel, Splunk, sventec, Github Community | 2021-07-12 | 2026-09-22 | a51bfe1a-94f0-48cc-b4e4-16a110145893 | - | ||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-28 | 2022-11-11 | f576a613-2392-4067-9d1a-9345fb58d8d1 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Detects failed AWS console login attempts due to authentication failures. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Ivan Saakov, Nasreddine Bencherchali | 2025-10-19 | — | 6393e346-1977-46ef-8987-ad414a145fad | ||||
Splunk | The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Gowthamaraj Rajendran, Splunk | 2022-08-07 | 2026-05-13 | 6153c5ea-ed30-4878-81e6-21ecdb198189 | |||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | c79c164f-4b21-4847-98f9-cf6a9f49179e | |||
Splunk | The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | 884a5f59-eec7-4f4a-948b-dbde18225fdc | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-05-01 | 2026-05-13 | 657902a9-987d-4879-a1b2-e7a65512824b | |||
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-06-29 | 2021-08-20 | 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Splunk | The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Michael Haag, Splunk | 2021-04-06 | 2026-05-13 | f19e09b0-9308-11eb-b7ec-acde48001122 | |||
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | toopricey | 2025-10-18 | — | 1279262f-1464-422f-ac0d-5b545320c526 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects when S3 bucket versioning is disabled. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sean Johnstone | Unit 42 | 2023-10-28 | — | a136ac98-b2bc-4189-a14d-f0d0388e57a7 |
92nd percentile · 92% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
99th percentile · 99% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 16 Enterprise techniques.
Technique Campaign use over its cumulative rule count.