malware

EnvyScout S0634

Type: malware
Platform: Windows
Created: 2 August 2021
Last modified: 11 April 2024

EnvyScout is a dropper that has been used by APT29 since at least 2021.[1]

Techniques61st pct

Tactics53rd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0634

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
	Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)	Emerging	experimental	file_event	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Daemon Stealth Hide Artifacts Hidden Files and Directories	-	high	Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)	2025-11-22	—	e710a880-1f18-4417-b6a0-b5afdf7e3023
	Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Name Resolution Poisoning and SMB Relay Credential Access Forced Authentication	CVE-2025-33073	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-06-20	—	0ed99dda-6a35-11ef-8c99-0242ac120002
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects attackers using tooling with bad opsec defaults. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)	2020-10-23	2024-08-15	a7c3d773-caef-227e-a7e7-c2f13c622329
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects network connections initiated by binaries that are not typically associated wi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Stealth Masquerading Privilege Escalation, Stealth Process Injection	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	c6db35af-8a0e-4b61-88ed-738e66f15715
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects CLR DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	d13c43f0-f66b-4279-8b2c-5912077c1780
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Wojciech Lesicki	2021-06-01	2022-09-16	ae9c6a7c-9521-42a6-915e-5aaa8689d529
	Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	medium	Julia Fomina, oscd.community	2020-10-05	2023-02-09	9386d78a-7207-4048-9c9f-a93a7c2d1c05
	Detects a CodePage modification using the "mode.com" utility. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	low	Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-19	—	d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
	Detects a CodePage modification using the "mode.com" utility to Russian language. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-17	—	12fbff88-16b5-4b42-9754-cd001a789fb3
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript Stealth Obfuscated Files or Information Compile After Delivery Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2019-02-11	2026-03-23	b730a276-6b63-41b8-bcf8-55930c8fc6ee
	Detects Wscript/Cscript executing a file with an uncommon (i.e. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2023-06-19	99b7460d-c9f1-40d7-a316-1f36f61d52ee
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
Splunk	The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk. (...)	Anomaly	stable	process_creation	windows	Sysmon	Initial Access Phishing Spearphishing Attachment	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	a51bfe1a-94f0-4822-b1e4-16ae10145893
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
	Detects the execution of the hdiutil utility in order to mount disk images.	Generic	test	process_creation	macos	-	Collection Archive Collected Data Archive via Utility Initial Access Phishing Spearphishing Attachment	-	medium	Omar Khaled (@beacon_exe)	2024-08-10	—	bf241472-f014-4f01-a869-96f99330ca8c

Title

Description

EnvyScout S0634

EnvyScout MITRE reference S0634

Standing S0634

Reach

Coverage

EnvyScout detections S0634