malware
RCSession is a backdoor written in C++ that has been in use since at least 2018 by Mustang Panda and by Threat Group-3390 (Type II Backdoor).[1][2][3]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
RCSession can store its obfuscated configuration file in the Registry under HKLM\SOFTWARE\Plus or HKCU\SOFTWARE\Plus.67
RCSession can compress and obfuscate its strings to evade detection on a compromised host.8
RCSession can gather system owner information, including user and administrator privileges.9
RCSession has used a file named English.rtf to appear benign on victim hosts.1011
RCSession can launch itself from a hollowed svchost.exe process.121314
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
84th percentile · 84% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
64th percentile · 64% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
64th percentile · 64% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 22 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
920 distinct rules cover the 22 techniques recorded for this malware. 635 Sigma · 285 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address. | Generic | test | - | - | Azure Threat Management · Microsoft 365 | - | medium | Austin Songer @austinsonger | 2021-08-23 | 2022-10-09 | d8b0a4fe-07a8-41be-bd39-b14afa025d95 | ||||
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization. | Generic | test | - | - | Azure Threat Management · Microsoft 365 | - | medium | Austin Songer @austinsonger | 2021-08-23 | 2022-10-09 | 0f2468a2-5055-4212-a368-7321198ee706 | ||||
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. (...) | Generic | test | - | - | Azure Threat Detection · Microsoft 365 | - | medium | Austin Songer @austinsonger | 2021-08-23 | 2022-10-09 | a3501e8e-af9e-43c6-8cd6-9360bdaae498 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | 2022-10-20 | 1e53dd56-8d83-4eb4-a43e-b790a05510aa | ||||
This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...) | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | — | 078235c5-6ec5-48e7-94b2-f8b5474379ea | ||||
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community | 2020-10-13 | 2024-12-01 | cd951fdc-4b2f-47f5-ba99-a33bf61e3770 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27 | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2018-09-03 | 2023-03-09 | 9aa01d62-7667-4d3b-acb8-8cb5103e2014 | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...) | Generic | test | image_load | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-01-22 | 2023-03-15 | 90ae0469-0cee-4509-b67f-e5efcef040f7 | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
An attempt to export an AWS EC2 instance has been detected. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Diogo Braz | 2020-04-16 | 2022-10-05 | 54b9a76a-3c71-4673-b4b3-2edb4566ea7b | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects specific windows registry modifications made by BlackByte ransomware variants. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-24 | 2025-10-21 | 83314318-052a-4c90-a1ad-660ece38d276 | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
detects BPFDoor .lock and .pid files access in temporary file storage facility | Generic | test | file_event | linux | Linux Auditd | - | high | Rafal Piasecki | 2022-08-10 | 2026-03-30 | 808146b2-9332-4d78-9416-d7e47012d83d | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Bypasses User Account Control using a fileless method | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-05 | 2023-08-17 | 46dd5308-4572-4d12-aa43-8938f0184d4f | ||||
Detects the setting of the environement variable "windir" to a non default value. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113, Nextron Systems | 2022-01-06 | 2024-01-30 | 724ea201-6514-4f38-9739-e5973c34f49a | ||||
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install sp (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community | 2019-10-24 | 2022-08-30 | e66779cc-383e-4224-a3a4-267eeb585c40 | ||||
Identifies use of Fodhelper.exe to bypass User Account Control. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community | 2019-10-24 | 2021-11-27 | 7f741dcf-fc22-4759-87b4-9ae8376676a2 | ||||
Detects use of WSReset.exe to bypass User Account Control (UAC). (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth | 2019-10-24 | 2022-05-13 | d797268e-28a9-49a7-b9a8-2f5039011c5c | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Detect possible persistence using Fax DLL load when service restart | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | 9e3357ba-09d4-4fbd-a7c5-ad6386314513 | ||||
Detect change of the user account associated with the FAX service to avoid the escalation problem. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | e3fdf743-f05b-4051-990a-b66919be1743 | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-14 | 2026-05-13 | a9079b18-1633-11ec-859c-acde48001122 | - |