malware

Siloscape S0623

Type: malware
Platforms: Windows, Containers
Created: 18 June 2021
Last modified: 25 April 2025

Siloscape is malware that targets Kubernetes clusters through Windows containers. Siloscape was first observed in March 2021.[1]

Techniques61st pct

Tactics53rd pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0623

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-21887 CVE-2023-46805 CVE-2023-46085	medium	Michael Haag, Splunk	2024-01-17	2026-05-13	15838756-f425-43fa-9d88-a7f88063e81a
Splunk	The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-29298 CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	d6821c0b-fcdc-4c95-a77f-e10752fae41a
Splunk	The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	695aceae-21db-4e7f-93ac-a52e39d02b93
	Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-40539	high	Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)	2021-09-20	2023-01-02	6702b13c-e421-44cc-ab33-42cc25570f11
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective	Emerging	test	process_creation	linux	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-20	—	c8a5f584-cdc8-42cc-8cce-0398e4265de3
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-19	2023-01-02	1a9a04fd-02d1-465c-abad-d733fd409f9c
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-20091 CVE-2021-20090	critical	Bhabesh Raj	2021-08-24	2023-01-02	f0500377-bc70-425d-ac8c-e956cd906871
	Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2022-36804	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-29	2023-01-02	65c0a0ab-d675-4441-bd6b-d3db226a2685
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space (...)	Emerging	experimental	process_creation	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Kernel Modules and Extensions Privilege Escalation Exploitation for Privilege Escalation	CVE-2026-31431	high	Gene Kazimiarovich	2026-05-09	—	474b415a-d917-4f3b-8c62-9e1a0d5f7b48
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects buffer overflow attempts in Unix system log files	Generic	test	-	linux	-	Privilege Escalation Exploitation for Privilege Escalation	-	high	Florian Roth (Nextron Systems)	2017-03-01	2025-03-17	18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.	Emerging	experimental	proxy	-	-	Initial Access Exploit Public-Facing Application	CVE-2025-20362 CVE-2025-20333	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-20	—	15697955-6a29-47ca-92e9-0e05efae3260
	Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code o (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-3452	high	Florian Roth (Nextron Systems)	2021-01-07	2023-01-02	aba47adc-4847-4970-95c1-61dce62a8b29
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Privilege Escalation Escape to Host	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	ff82a536-8fde-4963-a801-815826fcdf75
Splunk	The following analytic identifies the potential exploitation of the Cisco IOS XE vulnerability, CVE-2023-20198, in the Web User Interface. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-20198	medium	Michael Haag, Splunk	2023-10-17	2026-05-13	07c36cda-6567-43c3-bc1a-89dff61e2cd9
Splunk	This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	a113a8be-7386-46e0-a079-d9fd46f9631f
Splunk	This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-19	77a1751f-552f-456c-b9ae-cdb66eec3e42
Splunk	The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-09-08	f9686576-a23d-4c4d-bfad-a45499dc448a
Splunk	This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time. (...)	Hunting	stable	network_device	-	Cisco	Privilege Escalation Exploitation for Privilege Escalation	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	3df0e9a8-7d5e-4b2f-bcd7-bf93e671d1f2
Splunk	This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. (...)	Anomaly	stable	process_creation	-	Cisco	Privilege Escalation Escape to Host	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	2b8a7a21-bec6-4e1f-84c4-7b319f45d2ab
Splunk	This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...)	Generic	stable	network_connection	-	Cisco NVM · Cisco	Initial Access Exploit Public-Facing Application Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	1984f997-3b49-4d4b-a7e9-dc5dbf88370e
Splunk	This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry. (...)	Anomaly	stable	network_device	-	Cisco	Command and Control Proxy Multi-hop Proxy	-	medium	Mahamudul Chowdhury, Bhavin Patel, Splunk	2026-05-06	2026-06-09	a7c8613a-92e2-4232-b64d-bd39d33dee8b
Splunk	This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager. (...)	Generic	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20122 CVE-2026-20128 CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-12	2026-05-13	2f3862c6-45ff-4a02-9bd4-7e25c209fcd9
Splunk	This analytic identifies low-frequency Cisco SD-WAN control peering activity from control-connection-state-change events where "new-state:up". (...)	Anomaly	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	0fe052a5-07b8-48e7-9fc8-d6a3957eb914
Splunk	This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions. (...)	Hunting	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	1d192a47-4bd3-4c06-902d-5dbe2375ec6d
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Command and Control Application Layer Protocol Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	9f2295a0-0dcb-4a5f-b013-8a6f2a3c11f6
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-61882 CVE-2025-61884	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	9e995d21-6870-43de-acd9-76f372bcf323
Splunk	This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-61882 CVE-2025-61884	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	1c077b8a-95a3-4692-980d-c72fc50e9930
Splunk	This analytic detects exploitation activity of CVE-2025-55182 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-55182 CVE-2025-66478	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-07-17	2026-05-13	d36459b1-7901-401a-a67e-44426c15b168
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
Splunk	This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Impact Endpoint Denial of Service Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Bhavin Patel, Michael Haag, Splunk	2025-04-16	2026-05-13	7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
Splunk	This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to (...)	Generic	stable	network_connection	-	Splunk Stream TCP	Initial Access Exploit Public-Facing Application	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	3b8d2b4f-4e1e-4a9e-9b43-8a7a3a9c7e21
Splunk	This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. (...)	Generic	stable	network_connection	-	Splunk Stream TCP	Initial Access Exploit Public-Facing Application	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	ded9f9d7-edb8-48cf-8b72-1b459eee6785

Title

Description

Siloscape S0623

Siloscape MITRE reference S0623

Standing S0623

Reach

Coverage

Siloscape detections S0623