tool
Ferocious S0679
- Type
- malware
- Platform
- Windows
- Created
- 1 February 2022
- Last modified
- 25 April 2025
Ferocious is a first stage implant composed of VBS and PowerShell scripts that has been used by WIRTE since at least 2021.[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S0679
Ferocious has the ability to use Visual Basic scripts for execution.3
Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.5
Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.6
Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.7
Standing S0679
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
44th percentile · 56% of 825 ATT&CK software entries have more Enterprise techniques.
53rd percentile · 53% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
78th percentile · 78% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
Detection coverage S0679
605 distinct rules cover the 9 techniques recorded for this tool. The 619 technique-to-rule mappings resolve to 605 distinct rules, because one rule can cover several techniques. 419 Sigma · 186 Splunk.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org