malware
FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.[1][2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
FIVEHANDS can use WMI to delete files on a target machine.67
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.89
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.1011
FIVEHANDS can enumerate network shares and mounted drives on a network.12
FIVEHANDS has the ability to decrypt its payload prior to execution.131415
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
38th percentile · 62% of 825 ATT&CK software entries have more Enterprise techniques.
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
68th percentile · 68% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
92nd percentile · 92% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 8 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
346 distinct rules cover the 8 techniques recorded for this malware. 236 Sigma · 110 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations | Generic | test | image_load | windows | Sysmon | - | high | X__Junior (Nextron Systems) | 2023-07-11 | — | 799a5f48-0ac1-4e0f-9152-71d137d48c2a | ||||
Detects usage of winget to add a new insecure (http) download source. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-04-17 | — | 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 | ||||
Detects usage of winget to add new additional download sources | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-04-17 | — | 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 | ||||
Detects usage of winget to add new potentially suspicious download sources | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-04-17 | 2023-12-04 | c15a46a0-07d4-4c87-b4b6-89207835a83b | ||||
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2021-12-13 | 2024-05-10 | 639c9081-f482-47d3-a0bd-ddee3d4ecd76 | ||||
Detects loading of Amsi.dll by uncommon processes | Hunting | test | image_load | windows | Sysmon | - | low | frack113 | 2023-03-12 | 2026-06-29 | facd1549-e416-48e0-b8c4-41d7215eedc8 | ||||
Detects a highly relevant Antivirus alert that reports ransomware. (...) | Generic | test | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2022-05-12 | 2026-06-15 | 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2020-10-27 | 2026-05-13 | 16ae9076-d1d5-411c-8fdd-457504b33dac | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-10-04 | 2026-05-13 | f32598bb-fa5f-4afd-8ab3-0263cc28efbc | |||
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...) | Emerging | test | process_creation | linux | Sysmon | high | Nasreddine Bencherchali (Nextron Systems) | 2022-06-03 | — | 7fb14105-530e-4e2e-8cfb-99f7d8700b66 | |||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | c79c164f-4b21-4847-98f9-cf6a9f49179e | |||
Splunk | The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | 884a5f59-eec7-4f4a-948b-dbde18225fdc | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-05-01 | 2026-05-13 | 657902a9-987d-4879-a1b2-e7a65512824b | |||
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-06-29 | 2021-08-20 | 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 | ||||
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | toopricey | 2025-10-18 | — | 1279262f-1464-422f-ac0d-5b545320c526 | ||||
Detects when S3 bucket versioning is disabled. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sean Johnstone | Unit 42 | 2023-10-28 | — | a136ac98-b2bc-4189-a14d-f0d0388e57a7 | ||||
Identifies when a new cloudshell is created inside of Azure portal. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer | 2021-09-21 | 2022-08-23 | 72af37e2-ec32-47dc-992b-bc288a2708cb | ||||
Detects deletion of files with extensions often used for backup files. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | frack113 | 2022-01-02 | 2023-02-15 | 06125661-3814-4e03-bfa2-1e4411c60ac3 | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Splunk | The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-07 | 2026-05-13 | dc7a8004-0f18-11ec-8c54-acde48001122 | |||
Splunk | The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-01-11 | 2026-10-02 | 809b31d2-5462-11eb-ae93-0242ac130002 | |||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt. | Emerging | test | file_event | windows | WinEventLog Security | - | high | j4son | 2023-05-23 | — | eee8311f-a752-44f0-bf2f-6b007db16300 | ||||
Detects the use of the bcdedit command to tamper with the boot configuration data. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security | - | high | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community | 2019-10-24 | 2023-02-15 | 1444443e-6757-43e4-9ea4-c8fc705f79a2 | ||||
detects BPFDoor .lock and .pid files access in temporary file storage facility | Generic | test | file_event | linux | Linux Auditd | - | high | Rafal Piasecki | 2022-08-10 | 2026-03-30 | 808146b2-9332-4d78-9416-d7e47012d83d | ||||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Detects the use of the "capsh" utility to invoke a shell. | Generic | test | process_creation | linux | Sysmon | - | high | Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) | 2024-09-02 | — | db1ac3be-f606-4e3a-89e0-9607cbe6b98a | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Splunk | The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-07 | 2026-05-13 | 81f1dce0-0f18-11ec-a5d7-acde48001122 | |||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | ff82a536-8fde-4963-a801-815826fcdf75 | |||
Splunk | This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. (...) | Generic | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | a113a8be-7386-46e0-a079-d9fd46f9631f | |||
Modifications to a config that will serve an adversary's impacts or persistence | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2025-04-28 | 671ffc77-50a7-464f-9e3d-9ea2b493b26b | - | |||
Splunk | Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Maria Jose Erquiaga, Splunk | 2026-09-02 | 2026-09-22 | 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 | |||
Splunk | This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d | |||
Splunk | This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | cd0e816f-f67d-4dbe-a153-480b546e867e | |||
Splunk | The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | 24b2c2e3-2ff7-4a23-b814-87f8a62028cd | |||
Splunk | This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | medium | Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-07-17 | 2026-05-13 | 93db24a0-fd21-45d7-9daf-84afd5a8cca2 | ||||
Splunk | The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | 9f2295a0-0dcb-4a5f-b013-8a6f2a3c11f6 | |||
Splunk | The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall. (...) | Anomaly | experimental | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | 244a77bb-3b2a-46f1-bf2c-b4f7cd29276d | |||
Splunk | This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Michael Haag, Splunk | 2026-01-12 | 2026-05-13 | 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. (...) | Generic | experimental | image_load | windows | Sysmon | - | medium | X__Junior | 2025-01-20 | — | fb4e2211-6d08-426b-8e6f-0d4a161e3b1d | ||||
Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-08 | 2023-02-14 | 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f | ||||
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Tim Rauch, Elastic (idea) | 2022-09-28 | 2025-03-06 | cbb9e3d1-2386-4e59-912e-62f1484f7a89 |