malware

ProLock S0654

Type: malware
Platform: Windows
Created: 30 September 2021
Last modified: 17 November 2024

ProLock is a ransomware strain that has been used in Big Game Hunting (BGH) operations since at least 2020, often obtaining initial access with QakBot. ProLock is the successor to PwndLocker ransomware which was found to contain a bug allowing decryption without ransom payment in 2019.[1]

Techniques33rd pct

Tactics41st pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

ProLock MITRE reference S0654

Steganography T1027.003 ↗

ProLock can use .jpg and .bmp files to store its payload.2

Stealth5 detection rules

Windows Management Instrumentation T1047 ↗

ProLock can use WMIC to execute scripts on targeted hosts.3

Execution71 detection rules

Exploitation for Privilege Escalation T1068 ↗

ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.4

Privilege Escalation88 detection rules

File Deletion T1070.004 ↗

ProLock can remove files containing its payload after they are executed.5

Stealth30 detection rules

BITS Jobs T1197 ↗

ProLock can use BITS jobs to download its malicious payload.6

Execution · Persistence · Stealth21 detection rules

Data Encrypted for Impact T1486 ↗

ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.7

Impact27 detection rules

Standing S0654

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques733rd pct

33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique30medTop 22%

78th percentile · 78% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique10medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique3medTop 3%

97th percentile · 97% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 7 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 167Splunk ESCU (cumulative) · 116

Standing S0654

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2021-12-13	2024-05-10	639c9081-f482-47d3-a0bd-ddee3d4ecd76
	Detects loading of Amsi.dll by uncommon processes	Hunting	test	image_load	windows	Sysmon	Impact Inhibit System Recovery	-	low	frack113	2023-03-12	2026-06-29	facd1549-e416-48e0-b8c4-41d7215eedc8
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	f32598bb-fa5f-4afd-8ab3-0263cc28efbc
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space (...)	Emerging	experimental	process_creation	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Kernel Modules and Extensions Privilege Escalation Exploitation for Privilege Escalation	CVE-2026-31431	high	Gene Kazimiarovich	2026-05-09	—	474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Bhavin Patel, Splunk	2023-05-01	2026-05-13	657902a9-987d-4879-a1b2-e7a65512824b
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects when S3 bucket versioning is disabled. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Sean Johnstone \| Unit 42	2023-10-28	—	a136ac98-b2bc-4189-a14d-f0d0388e57a7
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects deletion of files with extensions often used for backup files. (...)	Generic	test	file_delete	windows	Sysmon	Impact Inhibit System Recovery	-	medium	frack113	2022-01-02	2023-02-15	06125661-3814-4e03-bfa2-1e4411c60ac3
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	dc7a8004-0f18-11ec-8c54-acde48001122
Splunk	The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Michael Haag, Splunk	2021-01-11	2026-10-02	809b31d2-5462-11eb-ae93-0242ac130002
	Detects an uncommon process loading the "BitsProxy.dll". (...)	Hunting	experimental	image_load	windows	Sysmon	Execution, Persistence, Stealth BITS Jobs	-	low	UnicornOfHunt	2025-06-04	—	e700ff14-1bff-4d1d-9438-738dff5f0466
Splunk	The following analytic detects the use of `bitsadmin.exe` to schedule a BITS job for persistence on an endpoint. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs	-	medium	Michael Haag, Splunk	2021-03-30	2026-10-02	e97a5ffe-90bf-11eb-928a-acde48001122
	Detects a BITS transfer job downloading file(s) from a direct IP address.	Generic	test	-	windows	BITS	Execution, Persistence, Stealth BITS Jobs	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-11	2023-03-27	90f138c1-f578-4ac3-8c49-eecfd847c8b7
	Detects BITS transfer job downloading files from a file sharing domain.	Generic	test	-	windows	BITS	Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-28	2026-03-29	d635249d-86b5-4dad-a8c7-d7272b788586
	Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious l (...)	Generic	test	-	windows	BITS	Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-28	2023-03-27	f8a56cb7-a363-44ed-a82f-5926bb44cd05
	Detects new BITS transfer job saving local files with potential suspicious extensions	Generic	test	-	windows	BITS	Execution, Persistence, Stealth BITS Jobs	-	medium	frack113	2022-03-01	2023-03-27	b85e5894-9b19-4d86-8c87-a2f3b81f0521
	Detects a suspicious download using the BITS client from a FQDN that is unusual. (...)	Generic	test	-	windows	BITS	Execution, Persistence, Stealth BITS Jobs	-	medium	Florian Roth (Nextron Systems)	2022-06-10	2025-02-28	6d44fb93-e7d2-475c-9d3d-54c9c1e33427
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	Detects the use of the bcdedit command to tamper with the boot configuration data. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2023-02-15	1444443e-6757-43e4-9ea4-c8fc705f79a2
	Detects buffer overflow attempts in Unix system log files	Generic	test	-	linux	-	Privilege Escalation Exploitation for Privilege Escalation	-	high	Florian Roth (Nextron Systems)	2017-03-01	2025-03-17	18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	81f1dce0-0f18-11ec-a5d7-acde48001122
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time. (...)	Hunting	stable	network_device	-	Cisco	Privilege Escalation Exploitation for Privilege Escalation	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	3df0e9a8-7d5e-4b2f-bcd7-bf93e671d1f2
	Modifications to a config that will serve an adversary's impacts or persistence	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Transmitted Data Manipulation Impact Inhibit System Recovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Persistence Server Software Component	-	medium	Austin Clark	2019-08-12	2025-04-28	671ffc77-50a7-464f-9e3d-9ea2b493b26b	-
Splunk	This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution, Persistence, Stealth BITS Jobs	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	cc695238-3117-4e60-aa83-4beac2a42c69
Splunk	This analytic detects suspicious downloads from common file sharing and content delivery platforms u (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution, Persistence, Stealth BITS Jobs	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	94ebc001-35e7-4ae8-9b0e-52766b2f99c7
Splunk	The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-05-13	cd80a6ac-c9d9-11eb-8839-acde48001122
	Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-08	2023-02-14	9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
	Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to co (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	2023-03-07	c73124a7-3e89-44a3-bdc1-25fe4df754b1
	Detects exploitation attempt of vulnerability described in CVE-2021-3156. (...)	Unsupported	unsupported	process_creation	linux	Linux Auditd	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156 CVE-2021.3156	high	Bhabesh Raj	2021-02-01	2023-03-24	5ee37487-4eb8-4ac2-9be1-d7d14cdc559f
	Detects exploitation attempt of vulnerability described in CVE-2021-3156. (...)	Unsupported	unsupported	process_creation	linux	Linux Auditd	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156 CVE-2021.3156	high	Bhabesh Raj	2021-02-01	2023-03-24	b9748c98-9ea7-4fdb-80b6-29bed6ba71d2
Splunk	The following analytic detects the use of PowerShell to delete shadow copies via the WMIC PowerShell module. (...)	Generic	stable	ps_script	windows	PowerShell	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-05-12	2026-10-02	5ee2bcd0-b2ff-11eb-bb34-acde48001122
	Shadow Copies deletion using operating systems utilities via PowerShell	Generic	stable	ps_classic_start	windows	PowerShell	Impact Inhibit System Recovery	-	high	frack113	2021-06-03	2023-10-27	87df9ee1-5416-453a-8a08-e8d4a51e9ce1
Splunk	The following analytic detects the deletion of shadow copies using the vssadmin.exe or wmic.exe utilities. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	David Dorsey, Splunk	2020-04-29	2026-10-09	b89919ed-ee5f-492c-b139-95dbb162039e

Title

Description