malware

DCSrv S1033

Type: malware
Platform: Windows
Created: 11 August 2022
Last modified: 11 April 2024

DCSrv is destructive malware that has been used by Moses Staff since at least September 2021. Though DCSrv has ransomware-like capabilities, Moses Staff does not demand ransom or offer a decryption key.[1]

Techniques38th pct

Tactics68th pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1033

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
	Detect a system being shutdown or put into different boot mode	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Stored Data Manipulation Impact Firmware Corruption Impact System Shutdown/Reboot	-	medium	Austin Clark	2019-08-15	2023-01-04	d94a35f0-7a29-45f6-90a0-80df6159967c	-
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	@SerkinValery, Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2023-08-17	ac9159cc-c364-4304-8f0a-d63fc1a0aabb
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects disabling the CrashDump per registry (as used by HermeticWiper)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Persistence, Defense Impairment Modify Registry	-	medium	Tobias Michalski (Nextron Systems)	2022-02-24	2023-08-17	2ff692c2-4594-41ec-8fcb-46587de769e0
	Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	CVE-2020-1048	high	EagleEye Team, Florian Roth (Nextron Systems), NVISO	2020-05-13	2024-03-25	7ec912f2-5175-4868-b811-ec13ad0f8567
	Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Jonhnathan Ribeiro, oscd.community	2020-10-16	2023-02-28	99cf1e02-00fb-4c0d-8375-563f978dfd37
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec	2022-03-18	2025-06-04	e2482f8d-3443-4237-b906-cc145d87a076
Splunk	The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	cd2cf33c-9201-11eb-a10a-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
Splunk	The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-05-13	39ebdc68-25b9-11ec-aec7-acde48001122
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
Splunk	The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-07	2026-05-13	1490f224-ad8b-11eb-8c4f-acde48001122
	Detect set UseActionCenterExperience to 0 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	3ae1a046-f7db-439d-b7ce-b8b366b81fa6
Splunk	The following analytic detects modifications to the registry that disable the CMD prompt application. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	ff86077c-9212-11eb-a1e6-acde48001122
Splunk	The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6ae0148e-9215-11eb-a94a-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	de81bc46-9213-11eb-adc9-acde48001122
	Identifies use of various commands to query a systems time. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Time Discovery	-	low	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-06-28	b243b280-65fe-48df-ba07-6ddea7646427
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects a driver load from a temporary directory	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Florian Roth (Nextron Systems)	2017-02-12	2021-11-27	2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	—	c420410f-c2d8-4010-856b-dffe21866437
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	2023-12-22	98dedfdd-8333-49d4-9f23-d7018cccae53
Splunk	The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry Credential Access OS Credential Dumping	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-10-09	0c7d8ffe-25b1-11ec-9f39-acde48001122
Splunk	The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.	Generic	stable	-	esxi	VMware ESXi · VMware	Impact Endpoint Denial of Service Impact System Shutdown/Reboot Discovery Virtual Machine Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-09-08	cfe094b4-0737-4a33-9d63-e0562ce2b883
	Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Impact System Shutdown/Reboot	-	medium	Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon	2023-09-04	—	2992ac4d-31e9-4325-99f2-b18a73221bb2
	Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-09	2023-08-17	90f342e1-1aaa-4e43-b092-39fda57ed11e

Title

Description

DCSrv S1033

DCSrv MITRE reference S1033

Standing S1033

Reach

Coverage

DCSrv detections S1033