malware
Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.[1][2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
72nd percentile · 72% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
83rd percentile · 83% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
981 distinct rules cover the 17 techniques recorded for this malware. 659 Sigma · 322 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-10-09 | 1fac1481-2dbc-48b2-9096-753c49b4ec71 | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-12-02 | 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 | ||||
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2021-12-13 | 2024-05-10 | 639c9081-f482-47d3-a0bd-ddee3d4ecd76 | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | 2022-10-20 | 1e53dd56-8d83-4eb4-a43e-b790a05510aa | ||||
This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...) | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | — | 078235c5-6ec5-48e7-94b2-f8b5474379ea | ||||
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | 2024-12-01 | cd951fdc-4b2f-47f5-ba99-a33bf61e3770 | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects loading of Amsi.dll by uncommon processes | Hunting | test | image_load | windows | Sysmon | - | low | frack113 | 2023-03-12 | 2026-06-29 | facd1549-e416-48e0-b8c4-41d7215eedc8 | ||||
Detects a highly relevant Antivirus alert that reports ransomware. (...) | Generic | test | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2022-05-12 | 2026-06-15 | 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
An application has been removed. (...) | Generic | test | - | windows | WinEventLog Application | - | low | frack113 | 2022-01-28 | 2022-09-17 | 570ae5ec-33dc-427c-b815-db86228ad43e | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2020-10-27 | 2026-05-13 | 16ae9076-d1d5-411c-8fdd-457504b33dac | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Patrick Bareiss, Splunk | 2022-10-04 | 2026-05-13 | f32598bb-fa5f-4afd-8ab3-0263cc28efbc | |||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Splunk | The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | c79c164f-4b21-4847-98f9-cf6a9f49179e | |||
Splunk | The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Rod Soto, Patrick Bareiss Splunk | 2020-10-27 | 2026-05-13 | 884a5f59-eec7-4f4a-948b-dbde18225fdc | |||
Splunk | The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-05-01 | 2026-05-13 | 657902a9-987d-4879-a1b2-e7a65512824b | |||
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-06-29 | 2021-08-20 | 16124c2d-e40b-4fcc-8f2c-5ab7870a2223 | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | toopricey | 2025-10-18 | — | 1279262f-1464-422f-ac0d-5b545320c526 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects when S3 bucket versioning is disabled. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sean Johnstone | Unit 42 | 2023-10-28 | — | a136ac98-b2bc-4189-a14d-f0d0388e57a7 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Identifies when a application is deleted in Azure. | Generic | test | cloud_audit | - | Azure Audit Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-09-03 | 2026-04-30 | 410d2a41-1e6d-452f-85e5-abdd8257a823 | ||||
Detects when a Container Registry is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 93e0ef48-37c8-49ed-a02c-038aab23628e | ||||
Detects when a Azure Kubernetes Cluster is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 9541f321-7cba-4b43-80fc-fbd1fb922808 | ||||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Identifies when a Azure Kubernetes network policy is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 08d6ac24-c927-4469-b3b7-2e422d6e3c43 | ||||
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 25cb259b-bbdc-4b87-98b7-90d7c72f8743 | ||||
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 7ee0b4aa-d8d4-4088-b661-20efdf41a04c | ||||
Identifies when ClusterRoles/Roles are being modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 818fee0c-e0ec-4e45-824e-83e4817b0887 | ||||
Identifies when a service account is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 12d027c3-b48c-4d9d-8bb6-a732200034b2 |
95th percentile · 95% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 17 Enterprise techniques.
Technique Campaign use over its cumulative rule count.